[Shrinandan-N]

Summary

POST /import passes user-uploaded zips to AdmZip(buf).extractAllTo("/tmp/extracted_files", true) (routes/index.js:255-257). adm-zip@0.4.7 does not sanitize entry names, so an entry like ../../usr/src/goof/public/about.html is written outside the target directory (Zip Slip, SNYK-JS-ADMZIP-1065796 / CWE-22).

This PR pins adm-zip to 0.6.1 in package.json and package-lock.json. No app code changes.

Why 0.6.1 and not 0.4.11? 0.4.11 fixes the Zip Slip bug, but npm audit still reports 7 adm-zip advisories against it (memory-allocation DoS, decompression-bomb bypass, SUID bits kept on extract, duplicate-entry confusion, etc.). Every 0.5.x release, including 0.5.18, is also still flagged, and 0.5.9 and later add a symlink-follow overwrite advisory. 0.6.1 is the first version with no npm audit advisories. The API the route uses, AdmZip(buffer) called without new and extractAllTo(path, overwrite), is the same in 0.6.1. Its engines field is node >=14, and the Dockerfile uses node:18.13.0.

Verification

Both runs used the same node:18.13.0 container with mongo:3, running the app as root the way the Dockerfile does. Each uploaded exploits/zip-slip/my_backup.zip and then exploits/zip-slip/malicious_backup.zip through POST /import:

	adm-zip 0.4.7 (main)	adm-zip 0.6.1 (this PR)
Benign zip import	302, /tmp/extracted_files/backup.txt written	302, /tmp/extracted_files/backup.txt written
Malicious zip import	302, /usr/src/goof/public/about.html overwritten ("HAHAHA GOTCHA!")	302, about.html unchanged (same md5). The entry lands inside the target dir as /tmp/extracted_files/usr/src/goof/public/about.html
Plain-text CSV import	302	302

npm test runs snyk test, which needs Snyk auth that isn't set up here, so it was not run.

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/8f06331b317a44d0b3a7879791d9eca1
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/8f06331b317a44d0b3a7879791d9eca1?variant=devin
Requested by: @Shrinandan-N

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	adm-zip@​0.4.7 ⏵ 0.6.1	+1	+50	+8

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.