Wiz
Vulnerability DatabaseCVE-2025-11569

CVE-2025-11569: 
JavaScript vulnerability analysis and mitigation

Overview

CVE-2025-11569 affects all versions of the cross-zip package, which is a Cross-platform .zip file creation utility. The vulnerability was discovered and disclosed on December 7, 2023, and published on October 9, 2025. The vulnerability allows for Directory Traversal attacks through the consecutive usage of zipSync() and unzipSync() functions that accept arguments such as __dirname (Snyk).

Technical details

The vulnerability is classified as a Directory Traversal (CWE-22) with a CVSS v4.0 score of 7.7 (High) and CVSS v3.1 score of 7.5 (High). The attack vector is network-based with low attack complexity, requiring no privileges or user interaction. The vulnerability primarily impacts confidentiality with high severity, while integrity and availability remain unaffected (NVD).

Impact

An attacker can exploit this vulnerability to access system files by selectively performing zip/unzip operations. The vulnerability allows attackers to read files stored outside the intended directory structure, potentially exposing sensitive system information (Snyk).

Mitigation and workarounds

Currently, there is no fixed version available for the cross-zip package (Snyk).

Additional resources

Source: This report was generated using AI

Related JavaScript vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

GHSA-365g-vjw2-grx8HIGH8.8
  • JavaScriptJavaScript
  • n8n
NoNoOct 09, 2025
GHSA-j44m-5v8f-gc9cHIGH7.7
  • JavaScriptJavaScript
  • flowise
NoYesOct 10, 2025
CVE-2025-11569HIGH7.7
  • JavaScriptJavaScript
  • cross-zip
NoNoOct 10, 2025
CVE-2025-61927HIGH7.2
  • JavaScriptJavaScript
  • happy-dom
NoYesOct 10, 2025
CVE-2025-61925MEDIUM6.5
  • JavaScriptJavaScript
  • astro
NoYesOct 10, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo