{"id":"CVE-2021-23484","aliases":["EUVD-2022-1241","GHSA-wxj7-97fp-j53j","SNYK-JS-ZIPLOCAL-2327477"],"status":"published","title":"Arbitrary File Write via Archive Extraction (Zip Slip)","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0205,"percentile":0.81381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-29","CWE-668"],"published":"2022-01-28T21:31:29Z","modified":"2026-10-20T10:54:32Z","fixes":[{"ecosystem":"npm","package":"zip-local","fixed_in":["0.3.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"zip-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5"}]}]},{"source":"osv","ecosystem":"npm","package":"zip-local","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.5"}]}]}],"products":[{"vendor":"zip-local_project","product":"zip-local"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-ZIPLOCAL-2327477","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Mostafa-Samir/zip-local/commit/949446a95a660c0752b1db0c654f0fd619ae6085","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23484","tags":["advisory"]},{"url":"https://github.com/Mostafa-Samir/zip-local/commit/6bb9b59733df379ac168aa705790bd8339b4bf9b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wxj7-97fp-j53j"},{"url":"https://github.com/Mostafa-Samir/zip-local","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-23484","title":"Arbitrary File Write via Archive Extraction (Zip Slip)","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","status":"published","published":"2022-01-28T21:31:29.458Z","modified":"2024-09-16T21:56:44.351Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2022-1241","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","status":"published","published":"2022-01-28T21:31:29Z","modified":"2024-09-16T21:56:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:07.221362Z"}],"ghsa":[{"id":"GHSA-wxj7-97fp-j53j","title":"Exposure of Resource to Wrong Sphere in Zip-Local","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","status":"published","published":"2022-02-01T00:46:01Z","modified":"2023-11-29T22:46:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-29","CWE-668"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2021-23484","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","status":"published","published":"2022-01-28T22:15:09.01Z","modified":"2026-06-17T03:38:47.963Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:04.178977Z"}],"osv":[{"id":"CVE-2021-23484","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","status":"published","published":"2022-01-28T22:15:09.01Z","modified":"2026-10-20T10:54:32.6135213Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-wxj7-97fp-j53j","title":"Exposure of Resource to Wrong Sphere in Zip-Local","description":"The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.","status":"published","published":"2022-02-01T00:46:01Z","modified":"2026-09-10T03:49:12.296259937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-29","CWE-668"],"updated_at":"2026-11-02T15:46:59.131095Z"}]}}