Is there a public PoC exploit available for CVE-2026-17514?

Yes, a public proof-of-concept exploit is available for CVE-2026-17514. Prioritise patching immediately. EPSS: 0.1%.

Node Unzipper CVE-2026-17514

Q: What is the CVSS score of CVE-2026-17514?

CVE-2026-17514 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-49201 LOW

Path Traversal (CWE-22)

2026-07-27 VulDB

GHSA-v23g-mcvj-659g

Path Traversal Node Unzipper

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 27, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Jul 27, 2026 - 14:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Jul 27, 2026 - 14:18 vuln.today

CVE Published

Jul 27, 2026 - 13:15 cve.org

MEDIUM 4.8

DescriptionCVE.org

A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in ZJONSSON node-unzipper up to version 0.12.3 allows local attackers with low privileges to write files outside the intended extraction directory by crafting a malicious archive. Exploit code is publicly available, but no active exploitation has been confirmed. The vendor has not yet responded to the vulnerability report.