CVE-2026-17514 | ZJONSSON node-unzipper up to 0.12.3 lib/extract.js Extract path traversal (Issue 357)

A vulnerability was found in ZJONSSON node-unzipper up to 0.12.3. It has been rated as critical. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal.

This vulnerability appears as CVE-2026-17514. The attack requires local access. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.