unzip-crx CVE-2026-78638

Local system access is required - the CVSS 4.0 AV:L metric confirms this is not remotely exploitable. Low-privilege user access is sufficient (PR:L); no administrative or root privileges are needed to trigger the flaw. Exploitation requires the ability to influence the destination argument passed to the unzip() function in dist/index.js, most realistically in applications or scripts that accept user-supplied or external input as the extraction target path. Impact is bounded by the write permissions of the process invoking unzip-crx: a restricted service account cannot overwrite files outside its own accessible paths. There is no confidentiality or availability impact (VC:N, VA:N per the CVSS vector) - the only effect is unauthorized file writes within the local filesystem. Non-default or special configurations are not required; any invocation of unzip() with an unsanitized destination is vulnerable.

The CVSS 4.0 base score of 4.8 (Medium) is supported by the vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, reflecting a local-only attack with low complexity, low privilege requirement, and limited impact confined to integrity. The E:P exploit maturity modifier is consistent with the confirmed publicly available proof-of-concept. KEV status is negative, meaning no confirmed widespread or in-the-wild exploitation has been reported to CISA. No EPSS data was provided, limiting probabilistic exploitation forecasting. The local attack vector (AV:L) is the primary risk-limiter: exploitation is not remotely triggerable and requires the attacker to already have local system access or the ability to influence input to the unzip() call. Practical risk is highest in CI/CD pipeline contexts where untrusted CRX archives are processed automatically and the destination argument is externally influenced. The absence of a vendor response and patch elevates residual risk for teams that have not implemented compensating controls, but the bounded impact (VI:L, no confidentiality or availability loss) keeps this from being an urgent priority for most deployments.

A local attacker with low-privilege access on a system where an application uses unzip-crx to process CRX files supplies a crafted destination argument containing ../ traversal sequences - for example, ../../etc/cron.d/backdoor - causing the unzip() function to extract archive contents to an arbitrary filesystem location outside the intended output directory. A publicly available proof-of-concept is referenced in GitHub issue #19, making reproduction straightforward for any local attacker who can influence the destination path passed to the library.