CVE-2026-19693

About vulnerability

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry’s own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

Affected product:

React , Vue , aegir , agent-browser , appium-execute-driver-plugin , astrojs-netlify , axe-core-npm , axe-core-webdriverio , browsers , chialab-es-dev-server , chialab-es-test-runner , chialab-esbuild-plugin-any-file , chialab-esbuild-plugin-env , chialab-esbuild-plugin-postcss , chialab-node-resolve , chialab-postcss-dart-sass , chialab-rna , chialab-rna-browser-test-runner , chialab-rna-config-loader , chialab-rna-dev-server , chialab-rna-logger , chialab-rna-node-test-runner , chialab-rna-saucelabs-test-runner , chialab-wds-plugin-hmr , chialab-wds-plugin-legacy , chialab-wds-plugin-node-resolve , chialab-wds-plugin-polyfill , chialab-wds-plugin-rna , chialab-wtr-coverage-reporter , chialab-wtr-mocha-reporter , chromedriver , cypress , desktop-mobile , electron , estimo , expect-webdriverio , expo , expo-electron-adapter , expo-image , expo-linking , expo-modules-core , expo-prebuild-config , expo-screen-capture , expo-standard-web-crypto , expo-status-bar , expo-symbols , extract-zip , find-chrome-bin , gatsby-cypress , gatsby-plugin-preload-fonts , gatsby-plugin-subfont , jest-expo-enzyme , jest-puppeteer-pkg , leafygreen-ui , lg-charts-colors , lg-tools-install , lg-tools-storybook-addon , libp2p-interfaces-compliance-tests , lighthouse , mastra , mastra-code-sdk , mastra-docker , mastra-factory , mastra-tanstack-start , mastracode , metamask-snaps-jest , modern-js-plugin-polyfill , modern-js-tsconfig , modern.js , netlify-dev , netlify-functions-dev , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , netlify/functions , nitro , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-core , percy-webdriverio , playwright , playwright-chromium , playwright-core , playwright-firefox , playwright-test , playwright-test-scoped , playwright-webkit , pptr-testing-library , puppeteer , puppeteer-core , rna , sb , size-limit , size-limit-esbuild , size-limit-esbuild-why , size-limit-file , size-limit-preset-app , size-limit-preset-big-lib , size-limit-preset-small-lib , size-limit-rolldown , size-limit-rolldown-why , size-limit-time , size-limit-webpack , size-limit-webpack-css , size-limit-webpack-why , smooth-code/jest-puppeteer , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-themes , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , subfont , vitest-webdriverio , wdio-allure-reporter , wdio-appium-service , wdio-browser-runner , wdio-browserstack-service , wdio-cli , wdio-concise-reporter , wdio-config , wdio-cucumber-framework , wdio-devtools-backend , wdio-dot-reporter , wdio-electrobun-service , wdio-electron-service , wdio-elements , wdio-firefox-profile-service , wdio-globals , wdio-jasmine-framework , wdio-json-reporter , wdio-junit-reporter , wdio-lighthouse-service , wdio-local-runner , wdio-mocha-framework , wdio-runner , wdio-sauce-service , wdio-shared-store-service , wdio-smoke-test-reporter , wdio-spec-reporter , wdio-static-server-service , wdio-sumologic-reporter , wdio-tauri-service , wdio-testingbot-service , wdio-utils , wdio-visual-service , wdio-webdriver-mock-service , web , web-browser-logs , web-config-loader , web-dev-server-hmr , web-dev-server-rollup , web-storybook-framework-web-components , web-test-runner , web-test-runner-browserstack , web-test-runner-chrome , web-test-runner-commands , web-test-runner-core , web-test-runner-coverage-v8 , web-test-runner-junit-reporter , web-test-runner-mocha , web-test-runner-puppeteer , web-test-runner-saucelabs , web-test-runner-selenium , web-test-runner-visual-regression , web-test-runner-webdriver , webdriver , webdriverio , webdriverio/devtools

Affected packages:

extract-zip @ 1.7.0 (+1894 more)