npmPackage

extract-zip

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: 2.0.1 (Jun 10, 2020): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 2 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-19693High 8.1
extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
Affected: from 1.0.0, through 2.0.1; through 2.0.1.
No fix released. The latest release, 2.0.1, is still affected.
100% of extract-zip downloads last week were affected versions (33.9M).
CVE-2026-56876High 8.1
extract-zip unvalidated symlink path traversal
Affected: through 2.0.1.
No fix released. The latest release, 2.0.1, is still affected.
100% of extract-zip downloads last week were affected versions (33.9M).