Arbitrary File Write

2022-01-3110:32:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

73.5%

JSON

zip-local is vulnerable to arbitrary file write (aka) zip-slip vulnerability. The unsynchronously unzipping leads to extraction of a malicious file outside the intended extraction directory.

CPENameOperatorVersion
zip-localle0.3.4
zip-localle0.3.4

CPE	Name	Operator	Version
	zip-local	le	0.3.4
	zip-local	le	0.3.4

References

github.com/Mostafa-Samir/zip-local/blob/master/main.js#L365

github.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365

github.com/Mostafa-Samir/zip-local/commit/949446a95a660c0752b1db0c654f0fd619ae6085

0.004 Low

EPSS

Percentile

73.5%

JSON

Related for VERACODE:33969