CVE-2026-78638: peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using peerigon unzip-crx or unzip-crx-3 version 0.2.0 or earlier are affected when a local user or process with the required privileges can control the destination argument passed to the unzip function.
What does an attacker need to exploit it?
Exploitation requires local access and low privileges. The attacker must be able to manipulate the destination argument used by dist/index.js's unzip function; no user interaction is required.
Is public exploit information available?
Yes. An exploit has been published, so affected deployments should treat locally controllable extraction destinations as an actionable risk.
What can be done if no patch is available?
Do not allow untrusted local users or inputs to control the extraction destination. Constrain destination paths to an approved directory and validate or canonicalize them before calling the unzip function.