GMS-2020-220: Arbitrary File Overwrite in decompress-zip

September 2, 2020 (updated September 27, 2021)

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. For decompress-zip upgrade to or later. For decompress-zip upgrade to or later.

References

github.com/advisories/GHSA-73v8-v6g4-vrpm
github.com/nodejs/security-wg/blob/master/vuln/npm/488.json
snyk.io/research/zip-slip-vulnerability
www.npmjs.com/advisories/777

Code Behaviors & Features

Detect and mitigate GMS-2020-220 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →