CVE-2021-23484: Path traversal in Zip-Local

January 28, 2022 (updated August 8, 2023)

The package zip-local is vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.

References

github.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365
github.com/Mostafa-Samir/zip-local/commit/949446a95a660c0752b1db0c654f0fd619ae6085
github.com/advisories/GHSA-wxj7-97fp-j53j
nvd.nist.gov/vuln/detail/CVE-2021-23484
snyk.io/vuln/SNYK-JS-ZIPLOCAL-2327477

Code Behaviors & Features

Detect and mitigate CVE-2021-23484 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →