This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g proto, toString, etc) results in a returned object with a modified prototype instance.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jszip | Jszip_project | * | 3.7.0 (excluding) |
| Node-jszip | Ubuntu | bionic | * |
| Node-jszip | Ubuntu | hirsute | * |
| Node-jszip | Ubuntu | impish | * |
| Node-jszip | Ubuntu | kinetic | * |
| Node-jszip | Ubuntu | lunar | * |
| Node-jszip | Ubuntu | mantic | * |
| Node-jszip | Ubuntu | trusty | * |
| Node-jszip | Ubuntu | xenial | * |