Add npm package mapping for GHSA-jmr9-qjv8-65gv (CVE-2026-56876, extract-zip) - #9025
Open
drengir1 wants to merge 2 commits into
Open
Conversation
…act-zip) The advisory currently has an empty `affected` array, so it is not associated with any package and does not surface in npm audit or Dependabot. The CVE record (assigner: CISA) names vendor `max-mapper`, product `extract-zip`, all versions affected.
github-actions
Bot
changed the base branch from
main
to
drengir1/advisory-improvement-9025
August 7, 2026 23:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GHSA-jmr9-qjv8-65gv(CVE-2026-56876) currently has an emptyaffectedarray, so it is not associated with any package. This PR maps it to the npm packageextract-zip.Why
The CVE record identifies the affected product unambiguously. From the CVE-2026-56876 CNA record (assigner: CISA):
max-mapperextract-zip0to*, withdefaultStatus: affectedmax-mapper/extract-zipis the source repository for the npm packageextract-zip, and the advisory text names the package by that name in its first sentence.Because the advisory carries no package mapping today,
npm auditand Dependabot do not surface it.extract-zipis currently at roughly 25.8M downloads per week and there is no fixed version, so the mapping seems worth having.Version range
There is no fixed release —
2.0.1is the latest published version and is affected — so this uses theintroduced: 0+last_affectedform this repository already uses for unfixed packages, e.g.GHSA-h39j-r5qq-r9mmfordecompress.The second commit only restores the original file ending (no trailing newline) so the net diff is confined to the
affectedfield.References
I also reproduced the behaviour against the published
extract-zip@2.0.1before opening this, as a check that the mapping is correct — but the mapping above rests entirely on the public CVE record.