~ / search / GHSA-36fh-84j7-cv5h

GHSA-36fh-84j7-cv5h

JSZip contains Path Traversal via loadAsync

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-48285

Packages

EcosystemPackageAffectedFixed in
npm jszip < 3.8.0 3.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

References

External links from the advisory. They lead to third-party sites.