CVE-2026-19693

About vulnerability

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry’s own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

Affected product:

appium-execute-driver-plugin , axe-core-npm , browsers , chromedriver , electron , expect-webdriverio , extract-zip , lighthouse , netlify-dev , netlify-functions-dev , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , netlify/functions , playwright-core , playwright-test , puppeteer , storybook , subfont , vitest-webdriverio , wdio-allure-reporter , wdio-appium-service , wdio-browserstack-service , wdio-cli , wdio-cucumber-framework , wdio-dot-reporter , wdio-globals , wdio-junit-reporter , wdio-local-runner , wdio-mocha-framework , wdio-runner , wdio-spec-reporter , web , web-test-runner-browserstack , web-test-runner-saucelabs , webdriverio

Affected packages:

@vitest/browser-webdriverio @ 4.0.18 (+318 more)