unzipper-0.12.1.tgz: 1 vulnerabilities (highest severity is: 5.3) #456

Vulnerable Library - unzipper-0.12.1.tgz

Library home page: https://registry.npmjs.org/unzipper/-/unzipper-0.12.1.tgz

Sample Path to Dependency File: /playground/package.json

Path to vulnerable library: /playground/package.json

Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389

CVE-2026-17514

Vulnerable Library - unzipper-0.12.1.tgz

Library home page: https://registry.npmjs.org/unzipper/-/unzipper-0.12.1.tgz

Sample Path to Dependency File: /playground/package.json

Path to vulnerable library: /playground/package.json

Dependency Hierarchy:

• ❌ unzipper-0.12.1.tgz (Vulnerable Library)

Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389

Found in base branch: develop

Vulnerability Details

A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Publish Date: 2026-07-27

URL: CVE-2026-17514

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-27

Fix Resolution: 0.12.5

Step up your Open Source Security Game with Mend here