CVE-2026-78638: Path Traversal in peerigon unzip-crx

This vulnerability in peerigon unzip-crx (up to version 0.2.0) allows local attackers to exploit a path traversal flaw in the unzip function of dist/index.js. By manipulating the destination argument, an attacker can cause files to be extracted outside the intended directory. The issue was responsibly disclosed early via an issue report, but no vendor response or patch is currently available. Exploit code is publicly available, increasing the risk of local exploitation.

Successful exploitation allows a local attacker to write files to arbitrary locations on the filesystem by leveraging path traversal during archive extraction. This could lead to overwriting critical files or placing malicious files in sensitive locations. However, the attack requires local access and low privileges, limiting the attack surface. There is no indication of remote exploitation or privilege escalation.

No official fix or patch is currently available from the vendor. Users should restrict local access to trusted users only and avoid running the vulnerable unzip-crx versions (0.1 and 0.2.0) in untrusted environments. Monitor the vendor's project for updates or patches. Consider using alternative archive extraction tools that do not exhibit this vulnerability.