Jszip
Source repositories
CVEs (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-48285 | Hig | 0.41 | 7.3 | 0.01 | Jan 29, 2023 | loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. | ||
| CVE-2021-23413 | Med | 0.28 | 5.3 | 0.03 | Jul 25, 2021 | This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. |
- risk 0.41cvss 7.3epss 0.01
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
- risk 0.28cvss 5.3epss 0.03
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.