EUVD-2026-65301
GHSA-5jh7-c63f-jp85
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low-privilege requirement confirmed by description; impact is limited to file write outside intended directory with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in peerigon unzip-crx and unzip-crx-3 (versions up to 0.2.0) enables a local, low-privileged attacker to write extracted archive files outside the intended destination directory by supplying a crafted path argument to the unzip() function. A publicly available proof-of-concept exploit exists via the GitHub issue tracker, and no vendor patch has been released as the project has not responded to the disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Local system access is required - the CVSS 4.0 AV:L metric confirms this is not remotely exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 4.8 (Medium) is supported by the vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, reflecting a local-only attack with low complexity, low privilege requirement, and limited impact confined to integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege access on a system where an application uses unzip-crx to process CRX files supplies a crafted destination argument containing ../ traversal sequences - for example, ../../etc/cron.d/backdoor - causing the unzip() function to extract archive contents to an arbitrary filesystem location outside the intended output directory. A publicly available proof-of-concept is referenced in GitHub issue #19, making reproduction straightforward for any local attacker who can influence the destination path passed to the library. |
| Remediation | No vendor-released patch has been identified at time of analysis - the maintainers have not responded to the responsible disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today