CVE-2026-78638

LOW 3.3

peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

CVSS Score

3.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	peerigon
Product	unzip-crx
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for peerigon unzip-crx

Be the first to know when new low vulnerabilities affecting peerigon unzip-crx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

peerigon / unzip-crx

0.1 0.2.0

peerigon / unzip-crx-3

0.1 0.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/394865 vuldb.com: https://vuldb.com/vuln/394865/cti vuldb.com: https://vuldb.com/cve/CVE-2026-78638 vuldb.com: https://vuldb.com/submit/886400 github.com: https://github.com/peerigon/unzip-crx/issues/19 github.com: https://github.com/peerigon/unzip-crx/

Credits

🔍 Classif1ed_mick (VulDB User) VulDB CNA Team