decompress-zip vulnerabilities

CVEs whose affected-version data names the decompress-zip package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107709High· 7.8

yesterday

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing en…

▾ TwilightBower Decompress-Zip · decompress-zipvia NVD