The extract-zip package versions up to 2.0.1 perform containment checks only on the parent directory of each archive entry, neglecting the final path component. An attacker can exploit this by including two entries with identical names: a symlink targeting a location outside the extraction directory, followed by a regular file. When extracted, the regular file writes through the symlink, enabling arbitrary file write outside the destination directory. This vulnerability is tracked as CVE-2026-19693 and is associated with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-59 (Link Following).

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory, potentially overwriting critical system or application files. This can lead to integrity violations and denial of service. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted zip archives with extract-zip versions through 2.0.1 or use alternative extraction tools that properly validate archive entries.