Vulnerable and unpatched extract-zip@2.0.1 dependency in npm distribution (CVE-2026-56876)

[Mcheimech]

The azure-functions-core-tools npm package currently depends on:

"extract-zip": "^2.0.1"

extract-zip version 2.0.1 is affected by the recently published and GitHub-reviewed security advisory:

• GHSA: GHSA-jmr9-qjv8-65gv
• CVE: CVE-2026-56876
• Severity: High
• CVSS: 8.6
• Affected versions: <= 2.0.1
• Patched version: None currently available

Advisory:
GHSA-jmr9-qjv8-65gv

The vulnerability relates to insufficient validation of symlink targets during ZIP extraction, which can allow paths outside the intended extraction directory to be referenced when processing a maliciously crafted archive.

Usage in Azure Functions Core Tools

extract-zip is not simply an unused/transitive dependency in Core Tools.

The npm installation script directly imports it:

const extract = require('extract-zip');

and uses it during postinstall to extract the downloaded Azure Functions Core Tools archive:

extract(file.path, { dir: installPath })

The archive is currently downloaded from the Microsoft Functions CDN before being extracted.

As a result, vulnerability/SCA scanners report azure-functions-core-tools installations as containing a High-severity vulnerable dependency.

Current limitation

At the time of writing, there is no patched version of extract-zip available, so simply upgrading the dependency is not currently possible.

extract-zip@2.0.1 also appears to be several years old and there has not yet been a subsequent npm release containing a fix.

Suggested options

Would the Azure Functions Core Tools team consider one of the following?

1. Track and upgrade to a patched extract-zip release if/when one becomes available.
2. Replace extract-zip with an actively maintained ZIP extraction library that performs appropriate path/symlink validation.
3. Implement additional validation around extraction in Core Tools as a temporary mitigation.
4. If the practical exploitability is considered sufficiently constrained because Core Tools only extracts archives retrieved from Microsoft's controlled CDN, document that assessment and any compensating controls so consumers have an authoritative response for SCA/security findings.

The fourth option would be particularly useful for organisations where security policy blocks builds or developer tooling when a High-severity dependency is detected, even where the application's actual usage may substantially reduce exploitability.

Additional context

This affects the npm distribution of Azure Functions Core Tools and can be observed through standard dependency/SCA scanning of:

azure-functions-core-tools
└── extract-zip@2.0.1

Given that there is currently no upstream patched version, it would be helpful to understand Microsoft's recommended mitigation and whether replacement of extract-zip is being considered.