zip-slip

Utility for creating ZipSlip archives

Utility script to test zip file upload functionality (and possible extraction of zip files) for vulnerabilities (aka Zip Slip)

Quick and Dirty POC for Zip Slip

Yara rules respository containing rules for exploits, malwares and cryptominers

Secure zip extraction for Rust & Python. Prevents Zip Slip, Zip Bombs, and symlink attacks.

Security-aware ZIP inspection for Python and CI: deterministic reports, policy checks, and safe extraction inspect before you extract.

Create and extract zip/tar archives with safe (zip-slip-proof) extraction by default. Pure Python, zero dependencies.

Simulates an archive's entry list against the destination tree and refuses any plan whose containment depends on entry order

Writeup du challenge YesWeHack Dojo 51 (DeadBolt) : Zip Path Traversal (Zip Slip) menant à une RCE via yauzl mal configuré

A container-only teaching demo for path traversal (CWE-22 / Zip Slip): resolve-and-confine done right, with an opt-in vulnerable contrast. Educational code, local-only — not for deployment.

What an archive will do when you unpack it. A zip lists its contents twice and nothing makes the two agree; this reads both. No uploads, no lookups, no telemetry.

CVE-2020-8254: Zip Slip in Pulse Secure VPN Windows Client

MAL-005: Zip Slip in Add Carbon Applications in WSO2 ESB

One import gives a scheduled script logging, retry, resume, and a safe unzip. Standard library only.

Generator for proof-of-concept archives demonstrating different "zip slip" / "tar slip" path-escape vulnerabilities in extractors. ZIP, TAR, 7z, RAR5 + compressed variants.

WSO2-2021-1258: Zip Slip vulnerability in WSO2 ESB

Zero-dependency ZIP engine in pure TypeScript — random-access reads, secure-by-default extraction (zip-slip & zip-bomb guards), deterministic reproducible archives, streaming, in-place incremental updates, worker parallelism. ISO/IEC 21320-1 validated in CI. Node ≥22, browsers, Deno, Bun, Workers. Built for modern apps and AI agents.