CVE-2026-56876: extract-zip Path Traversal Vulnerability

CVE-2026-56876 Overview

CVE-2026-56876 is a path traversal vulnerability [CWE-22] in the extract-zip Node.js library. The library fails to validate symbolic link targets when extracting zip archives. An attacker who crafts a malicious archive containing a symlink with a relative path such as ../../../../etc/passwd can cause extract-zip to write that symlink outside the intended extraction directory. Depending on how the consuming application uses extract-zip, this behavior enables arbitrary file read or arbitrary file write outside the extraction root. The issue is tracked under GitHub Security Advisory GHSA-x7jf-2287-qcpf.

Critical Impact
A malicious zip archive can plant symlinks pointing to arbitrary filesystem paths, enabling attackers to read or overwrite sensitive files outside the extraction directory.

Affected Products

extract-zip Node.js package (npm)
Applications and CLI tools that use extract-zip to unpack untrusted archives
Build pipelines and automation that rely on extract-zip for archive processing

Discovery Timeline

2026-06-26 - CVE-2026-56876 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-56876

Vulnerability Analysis

The extract-zip library iterates through entries in a zip archive and writes them to a target directory. Zip archives can contain symbolic link entries in addition to regular files and directories. During extraction, extract-zip writes the symlink as-is without checking whether the link target resolves inside the extraction root.

When a symlink entry contains a relative path such as ../../../../etc/passwd, the library creates that link on disk. Any subsequent read or write operation performed through the extracted path follows the symlink to a location outside the intended sandbox. In consuming applications that read extracted files, this yields arbitrary file read. In applications that write further data through extracted paths, it yields arbitrary file write. The vulnerability requires user interaction, typically triggered when a victim extracts a supplied archive.

Root Cause

The root cause is missing validation of symlink target paths [CWE-22]. extract-zip does not canonicalize the resolved target and does not verify that the resolved path remains within the extraction directory before creating the symbolic link on disk.

Attack Vector

Exploitation is network-reachable in the sense that malicious archives are typically delivered through downloads, uploads, package registries, or CI/CD inputs. An attacker crafts a zip file that contains a symlink entry with a traversal payload as its link target. The victim, or an automated process, invokes extract-zip on the archive. The library writes the malicious symlink. When the calling application subsequently accesses the extracted path, filesystem operations dereference the symlink and act on the attacker-chosen destination.

No verified public proof-of-concept code is provided in the referenced advisory. See the GitHub Security Advisory GHSA-x7jf-2287-qcpf for the vendor-supplied technical description.

Detection Methods for CVE-2026-56876

Indicators of Compromise

Symbolic links present inside extraction output directories whose targets resolve outside the extraction root.
Unexpected file modifications to sensitive paths such as /etc/passwd, ~/.ssh/authorized_keys, or application configuration files following an archive extraction event.
Zip archive entries whose stored symlink targets contain .. path segments or absolute paths.

Detection Strategies

Perform dependency scanning of Node.js projects to identify direct or transitive use of vulnerable extract-zip versions in package-lock.json and yarn.lock.
Inspect zip archives received from untrusted sources for symlink entries and flag any whose targets contain traversal sequences or absolute paths.
Correlate archive extraction process events with subsequent filesystem writes to sensitive directories.

Monitoring Recommendations

Enable filesystem auditing on sensitive paths and on directories used as extraction targets by Node.js services.
Log invocations of Node.js processes that spawn from web upload handlers or CI runners and review associated file creation events.
Alert on creation of symlinks by application service accounts, which is uncommon in most production workloads.

How to Mitigate CVE-2026-56876

Immediate Actions Required

Upgrade extract-zip to a patched version as identified in the GitHub Security Advisory.
Audit all applications, CLI tools, and CI pipelines that extract archives from untrusted sources and identify direct or transitive dependencies on extract-zip.
Treat archives received from external users, third-party downloads, or upstream registries as untrusted until validated.

Patch Information

Refer to the GitHub Security Advisory GHSA-x7jf-2287-qcpf and the CVE-2026-56876 CVE Record for the fixed version and release notes. Update the dependency in package.json and regenerate package-lock.json to propagate the fix across the dependency tree.

Workarounds

Reject archives that contain symlink entries before invoking extract-zip, or pre-scan archives and skip entries whose targets are absolute or contain ...
Extract archives inside an isolated directory under an unprivileged service account with no read or write access to sensitive filesystem locations.
Run extraction inside a container or chroot with a minimal filesystem view so traversal outside the extraction root cannot reach sensitive files.

bash

# Configuration example: upgrade extract-zip and verify
npm ls extract-zip
npm install extract-zip@latest
npm audit