Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. …

Versions of the npm package zip-lib before 1.1.0 are vulnerable to a Directory Traversal attack exploiting a flaw in the caching mechanism used for path validation during ZIP extraction. The security function isOutsideTargetFolder only validates and caches a path when a directory symlink is first created, allowing an attacker to bypass subsequent checks. By manipulating symlinks during extraction, an attacker can write files outside the intended target directory. The vulnerability is tracked as CVE-2026-17524 and also identified by Snyk as SNYK-JS-ZIPLIB-13834403. A fix was introduced in version 1.1.0 of zip-lib. The issue was reported via GitHub and patched in a documented commit. Users of zip-lib are strongly advised to upgrade to version 1.1.0 or later to remediate this risk.