CVE-2026-78638: unzip-crx Path Traversal Vulnerability

CVE-2026-78638 Overview

CVE-2026-78638 is a path traversal vulnerability in the peerigon unzip-crx and unzip-crx-3 Node.js packages through version 0.2.0. The flaw resides in the unzip function within dist/index.js, part of the Archive Extraction component. An attacker with local access can manipulate the destination argument to write extracted archive contents outside the intended directory. The issue is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A proof-of-concept has been published, and the maintainers have not yet responded to the issue report filed against the project.

Critical Impact
Local attackers can write files outside the intended extraction directory, enabling limited integrity impact on the local filesystem.

Affected Products

peerigon unzip-crx up to and including version 0.2.0
peerigon unzip-crx-3 up to and including version 0.2.0
Node.js applications consuming these packages for Chrome extension (CRX) archive extraction

Discovery Timeline

2026-08-25 - CVE-2026-78638 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78638

Vulnerability Analysis

The unzip-crx and unzip-crx-3 packages extract Chrome extension (.crx) archives to a caller-provided destination directory. The unzip function in dist/index.js does not properly sanitize or canonicalize file paths contained inside the archive before writing them to disk. An archive containing entries with relative traversal sequences such as ../ can cause files to be written outside the intended destination path.

This is a classic Zip Slip style flaw. The vulnerability requires local access and low privileges, and its effect is limited to integrity impact on the local filesystem. Confidentiality and availability are not directly affected. The exploit prediction score reflects the low likelihood of broad exploitation, but the published proof-of-concept lowers the barrier for targeted abuse.

Root Cause

The root cause is missing validation of archive entry paths before file creation. The extraction routine concatenates entry names onto the destination path without verifying that the resolved path stays within the destination directory. When an entry contains .. segments, path.join or equivalent operations resolve outside the intended base, allowing arbitrary write locations reachable by the process user.

Attack Vector

An attacker crafts a malicious CRX archive containing entries with directory traversal sequences in their filenames. When a downstream application invokes unzip with attacker-influenced archive content, the library writes files to attacker-controlled locations on the filesystem. Exploitation requires local access to the machine running the vulnerable code and the ability to influence either the archive content or the destination argument. Successful attacks can overwrite configuration files, drop scripts into auto-loaded directories, or plant files that later trigger execution through separate code paths.

No verified exploit code is included here. Refer to the GitHub Issue Discussion and the VulDB CVE-2026-78638 entry for additional technical details.

Detection Methods for CVE-2026-78638

Indicators of Compromise

Files written outside the expected extraction directory by processes that consume CRX archives
Archive entries containing ../ or absolute path prefixes within CRX files handled by Node.js services
Unexpected modifications to configuration files, startup scripts, or user profile directories following CRX extraction activity

Detection Strategies

Perform software composition analysis (SCA) across Node.js projects to identify dependencies on unzip-crx or unzip-crx-3 at version 0.2.0 or earlier
Instrument file system telemetry to flag write operations by Node.js processes that resolve paths above their working directory
Inspect CRX archives at ingestion time for entries with traversal sequences before passing them to extraction libraries

Monitoring Recommendations

Alert on filesystem writes by Node.js runtimes to sensitive locations such as ~/.ssh, ~/.bashrc, systemd unit paths, or scheduled task directories
Log invocations of unzip-crx and unzip-crx-3 along with the resolved destination path for post-incident review
Track dependency updates in package manifests to confirm remediation once a fixed release is available

How to Mitigate CVE-2026-78638

Immediate Actions Required

Inventory all Node.js applications and build pipelines using unzip-crx or unzip-crx-3 and treat the CRX extraction paths as untrusted
Restrict who can supply CRX archives to affected services and validate archive contents server-side before extraction
Run affected processes with least-privilege filesystem permissions to limit the blast radius of a successful traversal write

Patch Information

At the time of publication, the maintainers of peerigon unzip-crx and unzip-crx-3 had not responded to the disclosure and no fixed release is listed. Monitor the peerigon unzip-crx repository and the referenced GitHub Issue Discussion for updates. Consider migrating to an actively maintained archive extraction library that performs path canonicalization and rejects entries resolving outside the destination directory.

Workarounds

Replace unzip-crx/unzip-crx-3 with a maintained extraction library that validates entry paths against the destination root
Wrap calls to unzip with a pre-extraction check that iterates archive entries and rejects any name containing .. or absolute path components
Extract archives inside a sandboxed directory or container filesystem and copy validated files to their final destination afterward

bash

# Configuration example
# Audit and identify vulnerable versions across a Node.js project tree
npm ls unzip-crx unzip-crx-3

# Force removal from lockfiles once a replacement is chosen
npm uninstall unzip-crx unzip-crx-3