Path Traversal Vulnerability in unzip-crx by Peerigon
CVE-2026-78638

4.8MEDIUM

Key Information:

Vendor: Peerigon
Status: Unzip-crx; Unzip-crx-3
Vendor: CVE Published:; 25 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78638?

A security flaw has been identified in the unzip-crx library developed by Peerigon, specifically impacting versions up to 0.2.0. This vulnerability arises in the 'unzip' function located within the 'dist/index.js' file of the Archive Extraction component. By manipulating the 'destination' argument, an attacker could potentially exploit this flaw to conduct a path traversal attack. This type of attack can only be executed locally, and while the issue has been acknowledged through an early report, the project maintainers have yet to address it.

Affected Version(s)

unzip-crx 0.1

unzip-crx 0.2.0

unzip-crx-3 0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78638 - Proof of Concept