@zklogic/unzipper 0.13.2 → 0.13.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
{
|
|
2
|
+
"@context": "https://openvex.dev/ns/v0.2.0",
|
|
3
|
+
"@id": "https://github.com/ArfanKhalilMughal/node-unzipper/blob/master/vex/CVE-2026-17514.openvex.json",
|
|
4
|
+
"author": "@zklogic/unzipper maintainers",
|
|
5
|
+
"role": "maintainer",
|
|
6
|
+
"timestamp": "2026-09-03T00:00:00Z",
|
|
7
|
+
"version": 1,
|
|
8
|
+
"statements": [
|
|
9
|
+
{
|
|
10
|
+
"vulnerability": {
|
|
11
|
+
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-17514",
|
|
12
|
+
"name": "CVE-2026-17514"
|
|
13
|
+
},
|
|
14
|
+
"products": [
|
|
15
|
+
{
|
|
16
|
+
"@id": "pkg:npm/%40zklogic/unzipper@0.13.2"
|
|
17
|
+
},
|
|
18
|
+
{
|
|
19
|
+
"@id": "pkg:npm/%40zklogic/unzipper@0.13.3"
|
|
20
|
+
}
|
|
21
|
+
],
|
|
22
|
+
"status": "fixed",
|
|
23
|
+
"status_notes": "CVE-2026-17514 affects upstream ZJONSSON/node-unzipper versions 0.12.0 through 0.12.3. The path-relative containment fix is included in this package from v0.13.1 onward.",
|
|
24
|
+
"action_statement": "Extract and Open.extract resolve each archive path relative to the extraction root and reject paths outside that root. The behavior is covered by test/zipSlipSiblingPrefix.js.",
|
|
25
|
+
"timestamp": "2026-09-03T00:00:00Z"
|
|
26
|
+
}
|
|
27
|
+
]
|
|
28
|
+
}
|