CVE-2026-19693 max-mapper CVE debrief

Who should care

Developers and administrators using extract-zip package versions up to 2.0.1 should be aware of the potential for arbitrary file writes and take defensive actions. Operators, platforms, vulnerability-management teams, and security teams should assess affected scope and implement compensating controls where necessary.

Technical summary

The extract-zip package through 2.0.1 has a vulnerability where containment-checks only verify the parent directory of each archive entry, not the entry's final path component. This allows an archive with a symlink (targeting outside the destination) followed by a regular file to write through the symlink, resulting in an arbitrary file write outside the destination directory. Affected product deployments should be identified and verified for potential exposure.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.1 and potential for arbitrary file writes.

Recommended defensive actions

• Inventory and verify extract-zip versions up to 2.0.1 for containment-checks
• Assess affected scope and potential arbitrary file writes
• Monitor for vendor remediation and apply compensating controls
• Implement exception tracking and retest
• Enhance monitoring for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The evidence for this CVE is limited; verify containment-checks in extract-zip through 2.0.1 and assess affected scope; monitor for vendor remediation and apply compensating controls. Limited source detail is available; defensive verification tasks and evidence-limit language are required to ensure accurate understanding of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.