CVE-2026-19693

The vulnerability in extract-zip through 2.0.1 allows arbitrary file write via symlink traversal during archive extraction. The library implements parent-directory containment checks — it validates that each entry's parent path stays within the destination directory. This is the standard defense against zip slip, and it's incomplete. The gap: parent-directory checking validates the input path, not the resolved path. A symlink entry named `link -> ../../etc/passwd` has a parent directory that passes the containment check, but the resolved target escapes the sandbox. The attack works by placing a symlink entry followed by a regular file with an identical name — extraction writes through the symlink to the attacker-controlled location. Check your dependency tree for extract-zip, particularly as a transitive dependency. If your build pipeline, deployment tooling, or any system extracting archives from external sources uses this library, prioritize upgrading to 2.0.2 or later. The containment check must resolve symlinks before validation — use `realpath()` or equivalent to canonicalize the target path before confirming it stays within the destination boundary. The EPSS score of 0.0028 measures opportunistic attacker probability against internet-facing services, but this vulnerability's actual risk lives in the supply chain scenario. extract-zip is a hub dependency consumed by libraries and tooling that sit in build infrastructure. A single malicious archive in a package repository can detonate across thousands of downstream systems simultaneously — the EPSS model doesn't account for this blast radius. A CVSS 8.1 write primitive in a hub dependency warrants different treatment than the same score in a leaf utility. This is a known vulnerability pattern that has recurred across ecosystems for seven years despite comprehensive public documentation. The fix isn't documentation — it's that correct containment semantics require verbose implementation that's easy to get wrong, and the library ecosystem hasn't yet solved for making the secure implementation the path of least resistance.

Reviewed through automated stages and approved by a human before publication.