The Extract function in lib/extract.js of the node-unzipper library can be exploited by providing a ZIP archive that contains file names with directory traversal components. When extracted, these files are written to locations outside the intended extraction directory, allowing a local attacker to overwrite any file that the running process has permission to modify. This flaw leads to arbitrary file overwrite within the scope of local file permissions, potentially corrupting application configuration or binaries.

ZJONSSON:node-unzipper versions up to and including 0.12.3 are affected. No specific sub‑versions are identified beyond 0.12.3, so any release at or before that point remains vulnerable.

The CVSS score of 4.8 indicates moderate impact with a local attack vector. The EPSS score of < 1% implies a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The exposed path traversal enables a local attacker to overwrite files that the node process has permission to write, such as configuration files or binaries belonging to that user, but it does not provide elevated privileges beyond those available to the process. Successful exploitation requires local access; remote exploitation is not supported by the current description.