The node-unzipper package up to version 0.12.3 contains a path traversal vulnerability in the Extract function located in lib/extract.js. This flaw allows an attacker with local access to manipulate file paths during extraction, potentially leading to unauthorized file writes outside the intended directory. The vulnerability was reported early to the project but remains unaddressed, and the exploit details have been publicly disclosed. No official patch or remediation guidance has been provided by the vendor as of the publication date.

An attacker with local access can exploit this vulnerability to perform path traversal during archive extraction, potentially overwriting or creating files outside the intended extraction directory. This could lead to unauthorized file modification or code execution depending on the environment and usage context. The impact is limited by the requirement for local access and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting local access to trusted users only and avoid using affected versions until a patch is available. Monitoring the project repository or advisories for updates is recommended.