Search for packages
| purl | pkg:deb/debian/node-jszip@3.5.0%2Bdfsg-2 |
| Next non-vulnerable version | 3.10.1+dfsg-1 |
| Latest non-vulnerable version | 3.10.1+dfsg-1 |
| Risk | 3.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-nasw-3246-zfcd
Aliases: CVE-2022-48285 GHSA-36fh-84j7-cv5h |
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-wzyg-x1bp-yudd | This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. |
CVE-2021-23413
GHSA-jg8v-48h5-wgxg |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-13T08:15:53.942072+00:00 | Debian Oval Importer | Fixing | VCID-wzyg-x1bp-yudd | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |
| 2026-06-13T01:11:42.394190+00:00 | Debian Importer | Affected by | VCID-nasw-3246-zfcd | https://security-tracker.debian.org/tracker/data/json | 38.6.0 |