This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-19693 →
UBUNTU-CVE-2026-19693
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an arc...
Original description
The description as published by the source.
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:22.04:LTS
node-extract-zip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
node-extract-zip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
node-extract-zip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
node-extract-zip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org