2vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate2 (100.0%)
- Low0 (0.0%)
appium-support
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting appium-support, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-qfxx-c367-67f8 | Moderate | Appium: Symlink based Zip Slip in @appium/support ZIP extraction### Summary CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like `../evil.txt` was written outside the destination. That issue was fixed in @appium/support 7.0.6 by actually rejecting out of bound entry names. This finding is a different vector that the 7.0.6 fix does not cover. The archive entry names here are completely legitimate (for example `pwn` and `pwn/owned.txt`, no `..` a |
| GitHub (opens in a new tab) | |
| GHSA-rfx7-4xw3-gh4m | Moderate | @appium/support has a Zip Slip arbitrary file write in its ZIP extraction## Summary `@appium/support` contains a ZIP extraction implementation (`extractAllTo()` via `ZipExtractor.extract()`) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of `packages/support/lib/zip.js` creates an `Error` object but never throws it, allowing malicious ZIP entries with `../` path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the `fileNamesEncoding` option. ## Severity **Medium** (CVSS 3.1: 6.5) `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/ |
| GitHub (opens in a new tab) |
- GHSA-qfxx-c367-67f8ModerateAppium: Symlink based Zip Slip in @appium/support ZIP extraction
< 7.2.6
### Summary CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like `../evil.txt` was written outside the destination. That issue was fixed in @appium/support 7.0.6 by actually rejecting out of bound entry names. This finding is a different vector that the 7.0.6 fix does not cover. The archive entry names here are completely legitimate (for example `pwn` and `pwn/owned.txt`, no `..` a
CVE: CVE-2026-103975
- GHSA-rfx7-4xw3-gh4mModerate@appium/support has a Zip Slip arbitrary file write in its ZIP extraction
< 7.0.6
## Summary `@appium/support` contains a ZIP extraction implementation (`extractAllTo()` via `ZipExtractor.extract()`) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of `packages/support/lib/zip.js` creates an `Error` object but never throws it, allowing malicious ZIP entries with `../` path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the `fileNamesEncoding` option. ## Severity **Medium** (CVSS 3.1: 6.5) `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/
CVE: CVE-2026-30973