CVE-2026-17524

The CVE-2026-17524 entry concerns the zip-lib package for Node.js, with versions before 1.1.0 vulnerable to Directory Traversal during extraction via the caching path-validation logic. The root cause is that the isOutsideTargetFolder check is only performed when the initial directory symlink is c...

modern-web-swiss-army-knife (>=2.2.1, <=2.7.2) potentially affected by CVE-2026-17524 via zip-lib (>=1.0.4, <=1.0.5)

zip-lib NPM version =1.0.4, =2.2.1, =2.7.2 Source cves: CVE-2026-17524 Source advisory: SNYK:JS-ZIPLIB-13834403...