CVE-2026-17514

Name of the Vulnerable Software and Affected Versions node-unzipper versions prior to 0.12.4

Description A path traversal issue exists in the Extract() function within the lib/extract.js file. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the intended folder. This issue requires local access to be exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the Extract() function in lib/extract.js to minimize the risk of exploitation.