Not rated
CVE-2018-1002203 unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary…
Description
unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| unzipper 0.8 | earliest → < 0.8.13 | 0.8.13 |