Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...