Skip to content
Log inStart free trial

extract-zip (npm)

Zip extraction written in pure JavaScript. Extracts a zip into a directory.

Advisories
4
Latest version
2.0.1
Released Jun 10, 2020
License
BSD-2-Clause
OpenSSF Scorecard
3.0 / 10

How to fix

Upgrading to the latest version is recommended.

Upgrade commands
npm
npm install extract-zip@2.0.1
yarn
yarn add extract-zip@2.0.1
pnpm
pnpm add extract-zip@2.0.1

Known vulnerabilities

AdvisorySeverityAffectedFixed in
GHSA-7pqw-9j4j-h8q3
extract-zip allows arbitrary file writes through symlink archive entries
 High
EPSS 0.45%
<= 2.0.1
No fix yet
GHSA-7pqw-9j4j-h8q3
extract-zip allows arbitrary file writes through symlink archive entries
 High
EPSS 0.45%
<= 2.0.1
No fix yet
GHSA-jmr9-qjv8-65gv
extract-zip unvalidated symlink path traversal
 High
EPSS 0.53%
<= 2.0.1
No fix yet
GHSA-jmr9-qjv8-65gv
extract-zip unvalidated symlink path traversal
 High
EPSS 0.53%
<= 2.0.1
No fix yet

Source: git+https://github.com/maxogden/extract-zip.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor