loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
{ "ubuntu_priority": "medium" }