A path traversal vulnerability in the extract-zip package allows attackers to write files to arbitrary locations on the host system during the extraction process.

The software suffers from improper link resolution (CWE-59) and path traversal (CWE-22) flaws. An attacker can craft a zip file that, when extracted by the application, writes files outside of the intended target directory, potentially leading to system compromise.

Successful exploitation poses a severe risk, as an attacker could overwrite critical system files or inject malicious code into the application environment. With a CVSS score of 8.1, this vulnerability represents a high-risk scenario for any system that processes user-provided zip files.

Immediate Action: Update the extract-zip dependency to the latest secure version available in your package manager repository.

Proactive Monitoring: Monitor filesystem integrity for unauthorized file creation or modification events in sensitive system directories.

Compensating Controls: Implement strict input validation and sandboxing for processes that handle file extraction, ensuring that the extraction process runs with minimal system privileges.

Public Exploit Available: No

Due to the nature of path traversal vulnerabilities, the risk of remote code execution or system instability is high. Developers should audit their dependencies and update this package immediately to prevent potential file system manipulation.