The flaw resides in the unzip function of the Archive Extraction module of peerigon’s unzip-crx and unzip-crx-3 libraries. A crafted argument to the destination path can trigger the creation or overwrite of files outside the intended extraction directory. This path traversal is a classic example of CWE-22, enabling an attacker to place arbitrary files on the file system, which may include binaries or configuration files if permissions allow.

Peerigon’s unzip-crx and its fork unzip-crx-3, all versions up to and including 0.2.0, are affected. The vulnerability exists in the primary package (peerigon:unzip-crx) as well as in the older fork (peerigon:unzip-crx-3).

The CVSS score of 4.8 signals a moderate severity weakness. EPSS data is not available, but an exploit has been published and may be used. The attack vector is local only, requiring an attacker to have access to the Node environment that invokes the library. If the application runs with elevated privileges, arbitrary file overwrite could compromise system integrity, though it does not provision remote code execution or privilege escalation directly.