CVE-2018-1002203CWE-22

CVE-2018-1002203: vulnerability in node.js unzipper

Published 25 Jul 2018 · Updated 16 Sep 2024

Follow this CVE + Monitor unzipper + Monitor unzipper

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 11%

unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Affected products

node.js · unzipper

References

https://github.com/snyk/zip-slip-vulnerability https://github.com/ZJONSSON/node-unzipper/commit/2220ddd5b58f6252069a4f99f9475441ad0b50cd https://github.com/ZJONSSON/node-unzipper/pull/59 https://snyk.io/research/zip-slip-vulnerability https://snyk.io/vuln/npm:unzipper:20180415