extract-zip vulnerabilities (npm)

2 vulnerabilities.

• extract-zip npm extract-zip arbitrary file write outside the destination directory via a symlink at the final path component CVE-2026-19693 Fix available 8.1 HighAugust 17, 2026
• extract-zip npm extract-zip unvalidated symlink path traversal CVE-2026-56876 Public exploitFix available 8.6 HighJune 26, 2026