Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
stuk/jszip
main @ 643714a
4
Fixes
2
CVEs
HIGH
Peak severity
75.0%
Coverage
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
lib/flate.js: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Inadequate sanitization of ZIP entry file paths during archive loading permits directory traversal (Zip Slip), allowing files to be written outside the intended destination directory. This risk is tracked via CVE-2022-48285.
Prototype Pollution: Processing archives with crafted filenames (e.g., matching standard Object properties) can pollute the JavaScript prototype object chain, potentially corrupting application state or leading to remote code execution. This is tracked via CVE-2021-23413.
Information Disclosure: Older Node.js environments are vulnerable to uninitialized memory disclosure when buffer allocations do not explicitly zero-fill the allocated memory or perform strict type assertions on inputs.