extract-zip CVE-2026-19693

Exploitation requires that the target environment uses the extract-zip npm package at version 2.0.1 or earlier to process a ZIP archive containing at minimum two entries: a symlink entry whose name passes the parent-directory containment check but whose target resolves outside the destination, followed by a regular file entry with the identical archive name. The victim application or user must initiate extraction (CVSS UI:R) - there is no zero-click path against extract-zip itself. On Unix-like systems (Linux, macOS), no special OS-level privileges are needed; symlink creation is available to any unprivileged user, and the write impact extends to any path writable by the extraction process. On default Windows installations without Developer Mode or SeCreateSymbolicLinkPrivilege enabled, symlink creation by unprivileged processes is blocked, which substantially limits exploitability. Exploitation is further constrained to the write permissions of the process invoking extract-zip - a process running as a low-privilege service account limits blast radius compared to one running as root or SYSTEM. Non-default configurations or specially crafted archives are always required; this flaw does not manifest with standard well-formed ZIP files.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) reflects a realistic threat model: the attack is network-delivered, requires no attacker-side privileges, and is mechanically straightforward once a crafted archive is constructed. The sole friction is UI:R - a user or automated process must invoke extraction. In practice, this is a low barrier in CI/CD pipelines, software updaters, file-upload processors, and Electron-based applications that unpack user-supplied content. No EPSS score was provided in the intelligence data; without it, exploitation probability cannot be quantified numerically, but the attack class is well-documented and tooling to craft malicious ZIPs is freely available. There is no CISA KEV listing and no confirmed POC, so this is not confirmed actively exploited. However, the technique is reliable and deterministic - unlike race-condition symlink attacks - which raises real-world risk above what a raw EPSS absence might suggest. On Windows hosts, symlink creation for unprivileged users requires Developer Mode or SeCreateSymbolicLinkPrivilege, which materially limits impact on default Windows deployments. Unix/Linux and macOS environments face unrestricted symlink traversal within the process's write permissions.

An attacker crafts a ZIP archive with two entries sharing the same filename: the first is a symlink with a relative path that appears to remain within the destination (passing the parent-directory check) but whose target resolves to a sensitive out-of-bound path such as ~/.ssh/authorized_keys or a cron directory. The archive is delivered to a Node.js application - via a software update feed, a file upload endpoint, or a CI artifact download - and extract-zip is invoked to unpack it. extract-zip plants the symlink on the first entry, then writes the attacker-supplied file content through it on the second entry, depositing arbitrary data at the attacker-chosen target path with the privileges of the extraction process. No publicly released POC has been identified at time of analysis, but the technique is mechanically straightforward given established zip-slip research.