The extract-zip package through version 2.0.1 performs containment checks only on the parent directory of each archive entry and neglects the entry's own final path component. An attacker can exploit this by including two entries with identical names in a zip archive: first a symlink targeting a location outside the extraction directory, followed by a regular file with the same name. When extracted, the regular file overwrites the target of the symlink, enabling arbitrary file writes outside the destination directory. This is classified as CWE-59 (Improper Link Resolution Before File Access) and CWE-22 (Path Traversal).

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory, potentially overwriting critical system or application files. This can lead to integrity violations and denial of service. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impact.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is available, avoid extracting untrusted zip archives with vulnerable versions of extract-zip. Employ additional file system protections or sandboxing to limit the impact of arbitrary file writes.