N A CVE-2026-17524

We need to produce a comprehensive analysis in JSON format for CVE-2026-17524. The provided data includes description, CVSS, CWE, patch status, CPE, tags, references, EUVD info, and source code diff. We'll synthesize these into the required fields.

Let's analyze:

• CVE ID: CVE-2026-17524
• Description: Versions of zip-lib before 1.1.0 vulnerable to Directory Traversal via caching mechanism for path validation during extraction. Attacker can bypass security checks (isOutsideTargetFolder) that only checks and caches path status when initial directory symlink is created during first extraction.
• CVSS Score: 8.7 (CVSS 4.0 vector given)
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Patch: Available from vendor (references point to GitHub commit fixing issue)
• Reported by: snyk
• CPE: cpe:2.3:a:n/a:zip-lib:*:*:*:*:*:*:*:* (note: vendor is "n/a", product is "zip-lib")
• Tags: Path Traversal, Zip Lib
• ENISA EUVD ID: EUVD-2026-49687, affected versions: zip-lib 0 <1.1.0
• References: snyk advisory, GitHub commit, GitHub issue #14
• Source code evidence: Commit diff shows changes in fs.ts and unzip.ts. The fix involves ensuring folder creation returns symbolic link info and tracks symlink folders in EntryContext; the isOutsideTargetFolder function now checks symlinkFolders. This confirms the vulnerability and the fix.

Now, for fields:

product_name: "zip-lib" (the specific npm package). Short, 1-3 words. Could also be "zip-lib (npm)" but product_name should be plain "zip-lib".

summary: Need 2-3 sentences, original synthesis, not copied. Start with impact verb and product: "Directory traversal in zip-lib before 1.1.0 allows attackers to write files outside the intended extraction directory by exploiting a flawed caching mechanism that only validates symlink paths during initial directory creation." Mention affected product, what attacker can do, exploitation status (no KEV, no POC known? Actually no POC info in provided data;