CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3 . The issue is located in lib/decompress-zip.js, where the software improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive with entries resolving to prefix-sibling directories can ca...

EUVD-2026-95103

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CLSA-2026-1774225215 TuxCare security update for decompress-zip (1 CVE)

TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1...

PT-2026-74087

TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1...

The vulnerability of the PSDInput::decompress_zip_prediction() function in the src/psd.imageio/psdinput.cpp module of the OpenImageIO library allows a attacker to compromise the integrity of the protected information or cause service failures.

The vulnerability of the PSDInput::decompresszipprediction function in the src/psd.imageio/psdinput.cpp module of the OpenImageIO library is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the integrity of protected information or cause service...

PT-2025-54939

Уязвимость функции PSDInput::decompress zip prediction в модуле src/psd.imageio/psdinput.cpp библиотеки OpenImageIO связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность защищаемой информации или вызват...

Arbitrary File Overwrite in decompress-zip

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation For...

GHSA-73V8-V6G4-VRPM Arbitrary File Overwrite in decompress-zip

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation For...

@achingbrain/ngrok (0.2.2), @atomist/sdm-automation (>=0.1.16-master.20181116180810, <=0.1.59-master.20200611224542) +603 more potentially affected by unknown CVE via decompress-zip (>=0.0.2, <=0.2.0)

decompress-zip NPM version =0.0.2, =0.1.16-master.20181116180810, =14.0.5, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =1.1.1, =5.0.1, =1.0.0, =5.2.1, =5.3.0 - @paulcbetts/squirrel-windows 1.2.1 - @pgswe/ics.js 0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...

@angular/benchpress (0.1.0), @camptocamp/closure-util (>=1.20.0, <=1.27.0) +140 more potentially affected by unknown CVE via decompress-zip (>=0.3.0, <=0.3.1)

decompress-zip NPM version =0.3.0, =1.20.0, =0.4.0, =0.4.0, =0.5.0-beta.2, =1.36.0, =0.0.1, =3.6.0, =1.0.0, =0.1.0, =0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...

PT-2020-21110

Name of the Vulnerable Software and Affected Versions decompress-zip versions 0.2.x through 0.2.1 decompress-zip versions 0.3.x through 0.3.1 Description The issue is an arbitrary file write vulnerability, known as Zip-Slip, which occurs because decompress-zip does not verify that extracted files...

Arbitrary File Overwrite

Overview Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation...