node-extract-zip - Debian Package Tracker

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-56876: extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Created: 2026-06-27 Last update: 2026-06-27 07:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-56876: extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Created: 2026-06-27 Last update: 2026-06-27 07:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-56876: extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Created: 2026-06-27 Last update: 2026-06-27 07:00

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-56876: extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Created: 2026-06-27 Last update: 2026-06-27 07:00

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-56876: extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Created: 2026-06-27 Last update: 2026-06-27 07:00

4 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit ff83dbf9143c8cd0ed42ebd21bc6ef9a1b6b3219
Author: Xavier Guimard <yadd@debian.org>
Date:   Sun Jun 28 16:46:39 2026 +0200

    debian/watch version 5

commit 575274169192b68e1aa4e59b501ebc9ff33dcb19
Author: Xavier Guimard <yadd@debian.org>
Date:   Sun Jun 28 16:46:33 2026 +0200

    Drop "Priority: optional"

commit d850fddfd872e71c3ff4044a761cdf8d88f4c006
Author: Xavier Guimard <yadd@debian.org>
Date:   Sun Jun 28 16:46:33 2026 +0200

    Drop "Rules-Requires-Root: no"

commit 39df15ed1bc3b3af596d4ae50bbe496d3d8b5344
Author: Xavier Guimard <yadd@debian.org>
Date:   Sun Jun 28 16:46:33 2026 +0200

    Declare compliance with policy 4.7.4

Created: 2026-06-28 Last update: 2026-06-28 16:51

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.1).

Created: 2022-12-17 Last update: 2026-03-31 15:01