Exposure of Resource to Wrong Sphere in Zip-Local

CRITICO 9.8CVE-2021-23484 · GHSA-wxj7-97fp-j53j · SNYK-JS-ZIPLOCAL-2327477 · Published 28/01/2022 · updated 17/06/2026

In breve

CVE-2021-23484 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda zip-local (zip-local project), zip-local.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 81.4% delle vulnerabilità.
Correzione: aggiornare a 0.3.5 o successiva.

Package	Affected versions	Patched versions
zip-local zip-local_project	`< 0.3.5`	`0.3.5`
zip-local npm	`< 0.3.5`	`0.3.5`

Description

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-23484 · ADVISORY
Mostafa-Samir/zip-local commit 6bb9b59 · WEB
Mostafa-Samir/zip-local commit 949446a · WEB
Mostafa-Samir/zip-local · PACKAGE
Mostafa-Samir/zip-local · WEB
snyk.io/vuln/SNYK-JS-ZIPLOCAL-2327477 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free