diff --git a/pkgs/by-name/ru/runzip/package.nix b/pkgs/by-name/ru/runzip/package.nix
index 1beae9283ca6..e03077e804bd 100644
--- a/pkgs/by-name/ru/runzip/package.nix
+++ b/pkgs/by-name/ru/runzip/package.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tool to convert filename encoding inside a ZIP archive";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.raskin ];
+    # runzip vendors libzip 0.7.1.
+    knownVulnerabilities = [
+      "CVE-2015-2331"
+      "CVE-2017-14107"
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "runzip";
   };