This vulnerability affects the peerigon unzip-crx and unzip-crx-3 packages up to version 0.2.0. The issue is in the unzip function of dist/index.js, where improper handling of the destination argument allows local attackers to perform path traversal attacks. This can lead to unauthorized file writes outside the intended extraction directory. Although an exploit is publicly available, the attack requires local access. The vendor has been notified but has not provided a patch or mitigation guidance as of the publication date.

An attacker with local access can exploit this vulnerability to write files outside the intended extraction directory by manipulating the destination argument, potentially overwriting critical files. This could lead to local privilege escalation or system compromise depending on the context in which unzip-crx is used. There is no indication of remote exploitation or active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should avoid running the unzip function with untrusted inputs or restrict local access to trusted users only until a patch is available.