{"id":"CVE-2026-19693","revision":"eff261523c9744c6a35f7e3c19b96d94","records":[{"revision":"eff261523c9744c6a35f7e3c19b96d94","observedAt":"2026-10-25T05:17:25.909+00:00","statement":{"source":"nvd","id":"CVE-2026-19693","aliases":[],"title":"extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the d…","description":"extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.","state":0,"publishedAt":"2026-08-17T14:20:20.737+00:00","modifiedAt":"2026-09-09T15:52:04.827+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 22e2d327-25fe-45d7-9f0c-dcd23b7108df · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/max-mapper/extract-zip","https://www.npmjs.com/package/extract-zip"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19693","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22","CWE-59"],"productCriteria":[],"sourceDates":{"published":"2026-08-17T14:20:20.737","lastModified":"2026-09-09T15:52:04.827"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-19693","identifiers":["CVE-2026-19693"]},"retained":false,"historicalAffected":[]}],"coverage":[]}