Skip to content
Fencer Intel
high —

GHSA-73v8-v6g4-vrpm json

Arbitrary File Overwrite in decompress-zip

published 6y ago modified 6y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.

## Recommendation

For `decompress-zip` 0.2.x upgrade to 0.2.2 or later. For `decompress-zip` 0.3.x upgrade to 0.3.2 or later.

Patch / fix

  • npm decompress-zip 0.2.2, 0.3.2

Is GHSA-73v8-v6g4-vrpm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm decompress-zip
<0.2.2
>=0.3.0, <0.3.2
0.2.2
0.3.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.