CVE-2026-78638
Received Received - Intake

Path Traversal in unzip-crx and unzip-crx-3

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulDB

Description
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78638
EUVD
EUVD-2026-65301

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
peerigon unzip-crx 0.2.0
peerigon unzip-crx-3 to 0.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the unzip-crx and unzip-crx-3 libraries up to version 0.2.0. It occurs in the Archive Extraction function of dist/index.js. When extracting files, a manipulated destination argument can allow writing files outside the intended directory. The attack is local and requires crafted ZIP or CRX archives with backslash traversal segments like ..\filename.txt. The exploit has been published and may be used.

Detection Guidance

Check if unzip-crx or unzip-crx-3 versions up to 0.2.0 are installed using npm list unzip-crx or npm list unzip-crx-3. Inspect ZIP/CRX files for backslash traversal patterns like ..\ in entry names using tools like zipinfo or 7z l archive.crx.

Impact Analysis

This vulnerability allows attackers to write files outside the intended extraction directory on Windows systems. This could lead to file overwrites or creation of malicious files in sensitive locations. Since the exploit works even with a plain crafted ZIP renamed to .crx, the risk applies to users processing untrusted archives with these libraries.

Mitigation Strategies

Uninstall unzip-crx and unzip-crx-3 immediately. Use alternative libraries like adm-zip or jszip for CRX extraction. Validate all ZIP/CRX entry paths to ensure they stay within the intended directory. Monitor for unexpected file writes outside extraction folders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78638. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart