Vulnerable and unpatched extract-zip@2.0.1 dependency in npm distribution (CVE-2026-56876)

The `azure-functions-core-tools` npm package currently depends on:

```json
"extract-zip": "^2.0.1"
```

`extract-zip` version 2.0.1 is affected by the recently published and GitHub-reviewed security advisory:

* **GHSA:** GHSA-jmr9-qjv8-65gv
* **CVE:** CVE-2026-56876
* **Severity:** High
* **CVSS:** 8.6
* **Affected versions:** `<= 2.0.1`
* **Patched version:** None currently available

Advisory:
https://github.com/advisories/GHSA-jmr9-qjv8-65gv

The vulnerability relates to insufficient validation of symlink targets during ZIP extraction, which can allow paths outside the intended extraction directory to be referenced when processing a maliciously crafted archive.

## Usage in Azure Functions Core Tools

`extract-zip` is not simply an unused/transitive dependency in Core Tools.

The npm installation script directly imports it:

```javascript
const extract = require('extract-zip');
```

and uses it during `postinstall` to extract the downloaded Azure Functions Core Tools archive:

```javascript
extract(file.path, { dir: installPath })
```

The archive is currently downloaded from the Microsoft Functions CDN before being extracted.

As a result, vulnerability/SCA scanners report `azure-functions-core-tools` installations as containing a High-severity vulnerable dependency.

## Current limitation

At the time of writing, there is **no patched version of `extract-zip` available**, so simply upgrading the dependency is not currently possible.

`extract-zip@2.0.1` also appears to be several years old and there has not yet been a subsequent npm release containing a fix.

## Suggested options

Would the Azure Functions Core Tools team consider one of the following?

1. **Track and upgrade to a patched `extract-zip` release** if/when one becomes available.
2. **Replace `extract-zip` with an actively maintained ZIP extraction library** that performs appropriate path/symlink validation.
3. **Implement additional validation around extraction** in Core Tools as a temporary mitigation.
4. If the practical exploitability is considered sufficiently constrained because Core Tools only extracts archives retrieved from Microsoft's controlled CDN, **document that assessment and any compensating controls** so consumers have an authoritative response for SCA/security findings.

The fourth option would be particularly useful for organisations where security policy blocks builds or developer tooling when a High-severity dependency is detected, even where the application's actual usage may substantially reduce exploitability.

## Additional context

This affects the npm distribution of Azure Functions Core Tools and can be observed through standard dependency/SCA scanning of:

```text
azure-functions-core-tools
└── extract-zip@2.0.1
```

Given that there is currently no upstream patched version, it would be helpful to understand Microsoft's recommended mitigation and whether replacement of `extract-zip` is being considered.

Inspect the npm dependency declaration and the npm installation script that imports extract-zip and extracts the downloaded archive. Review the linked GHSA/CVE and determine whether a maintained replacement, additional validation, or documented compensating controls is appropriate. Done means the team has a concrete mitigation or an authoritative security assessment.

Written by the indexing model from the issue text.