Security issue with "extract-zip" and outdated "puppeteer" version
Author: koehnleinCreated Aug 13, 2026Updated Sep 8, 2026
Hi everybody,
there is current security issue with "extract-zip" https://github.com/advisories/GHSA-jmr9-qjv8-65gv
Unfortunately, this is related to BackstopJS as you can see here below. While there is also "puppeteer" in this chain, there is no hope, they will solve the problem for us: https://github.com/puppeteer/puppeteer/issues/15333
It would be great to see an update of BackstopJS which uses a newer version of puppeteer.
# npm audit report
extract-zip *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/extract-zip
@puppeteer/browsers <=2.13.2
Depends on vulnerable versions of extract-zip
node_modules/@puppeteer/browsers
puppeteer 19.8.1 - 24.43.1
Depends on vulnerable versions of @puppeteer/browsers
Depends on vulnerable versions of puppeteer-core
node_modules/puppeteer
backstopjs >=6.3.1
Depends on vulnerable versions of puppeteer
node_modules/backstopjs
puppeteer-core 19.8.4 - 24.43.1
Depends on vulnerable versions of @puppeteer/browsers
node_modules/puppeteer-coreSource: garris/BackstopJS