Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CVE-2026-30973 (GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by actually rejecting out of bound entry names. This finding is a different vector that the 7.0.6 fix does not cover. The archive entry names here are completely legitimate (for example pwn and pwn/owned.txt, no .. anywhere), so every name based defense accepts them. The escape happens through a symbolic link. One entry is a symlink whose target points outside the extraction directory, and a later entry is a regular file whose name resolves through that symlink. The name based containment check never inspects the symlink target, and the extractor writes the symlink target verbatim, so the file lands outside the extraction root. The two issues compared on the same patched version 7.2.5: | |…
Recommended action: Upgrade to 7.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. Severity Medium (CVSS 3.1: 6.5) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Attack Vector: Network — malicious ZIP files can be supplied over the network (e.g., app packages via URL) - Attack Complexity: Low — no special conditions required beyond providing a crafted ZIP - Privileges Required: None — no authentication needed to supply a malicious archive - User Interaction: Required — a user or automation system must initiate extraction of the attacker's archive - Scope: Unchanged — impact…
Recommended action: Upgrade to 7.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.