Security: bump puppeteer past v25 to drop vulnerable extract-zip dependency (CVE-2026-56876, CVE-2026-19693)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- node.js, typescript
Research direction
Start in memlab’s package manifest where puppeteer@24.31.0 is pinned; check the dependency tree before and after updating it to Puppeteer 25.x or later. Verify that @puppeteer/browsers is on 3.x, extract-zip is no longer present, and the two cited advisories no longer appear.
Written by the indexing model from the issue text.
Description
Summary
memlab currently pins puppeteer@24.31.0, which pulls in @puppeteer/browsers@2.x → extract-zip@2.0.1. This version of extract-zip has two high-severity, currently unpatched advisories:
- GHSA-jmr9-qjv8-65gv / CVE-2026-56876 - unvalidated symlink path traversal (CVSS 8.1)
- GHSA-7pqw-9j4j-h8q3 / CVE-2026-19693 - arbitrary file write via symlink archive entries (CVSS 8.1)
Both advisories list patched_versions: <0.0.0 — extract-zip itself will not be fixed.
Fix path
@puppeteer/browsers@3.x already removed extract-zip entirely in favor of modern-tar. Puppeteer 25.x depends on @puppeteer/browsers@3.x, so bumping memlab's puppeteer dependency past v25 would drop the vulnerable transitive dependency completely.
Ask
Could memlab's puppeteer pin be bumped to 25.x (or later)? This would resolve both advisories for everyone depending on memlab.
Happy to help test if useful.
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 148
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from facebook/memlab
-
Playwright Support Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100