github tristanisham/zvm v0.8.11
feat(security): Zip Slip & Arbitrary Code Execution/File Deletion Vulnerabilities

3 hours ago

What's Changed

  • Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #140

New Contributors

Full Changelog: v0.8.10...v0.8.11

feat(security): Implement robust path and archive extraction safeguards

This commit addresses several security vulnerabilities related to path traversal and insecure archive extraction.

  1. Path Traversal Prevention (cli/config.go, cli/uninstall.go)

Introduced os.OpenRoot for file system operations in getVersion and Uninstall functions.
This confines all file access to the designated base directory, effectively mitigating path traversal vulnerabilities that could lead to:

arbitrary code execution (via zvm use / run / sync)

arbitrary file deletion (via zvm uninstall)

  1. Zip Slip Remediation (cli/upgrade.go)

Enhanced the untar function with explicit path validation using filepath.Abs and strings.HasPrefix.
This ensures that files extracted during the upgrade process cannot be written outside the intended temporary directory, protecting against arbitrary file writes from a malicious tarball.

Don't miss a new zvm release

NewReleases is sending notifications on new releases.