168 matches found
ROOT-APP-NPM-GHSA-RCW4-F5RP-G42V GHSA-rcw4-f5rp-g42v in adm-zip - Patched by Root
Root has patched GHSA-rcw4-f5rp-g42v in the adm-zip package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-102282 CVE-2026-102282 in adm-zip - Patched by Root
Root has patched CVE-2026-102282 in the adm-zip package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-8238-W5PM-2374 GHSA-8238-w5pm-2374 in adm-zip - Patched by Root
Root has patched GHSA-8238-w5pm-2374 in the adm-zip package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-39244 CVE-2026-39244 in adm-zip - Patched by Root
Root has patched CVE-2026-39244 in the adm-zip package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-77301 CVE-2026-77301 in adm-zip - Patched by Root
Root has patched CVE-2026-77301 in the adm-zip package for Root:npm. Multiple fixed versions available...
CLSA-2026-1791315520 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.4.7-tuxcare.2...
Linux Distros Unpatched Vulnerability : CVE-2026-102282
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm- zip applies the Unix permission bits stored in a zip...
CVE-2026-102282
A flaw was found in adm-zip. This vulnerability allows privilege escalation when untrusted archives are extracted with original file permissions enabled. The library fails to filter out special Unix execution flags, such as setuid or setgid, from extracted files. If an administrative process...
CVE-2026-102282
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
EUVD-2026-92493
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
CVE-2026-102282
The adm-zip Node.js library (prior to 0.6.1 ) contains a vulnerability where it preserves SUID , SGID , and sticky bits from untrusted ZIP archives when the keepOriginalPermission=true flag is enabled. Specifically, the fileAttr property in headers/entryHeader.js uses an incorrect bitmask (0xfff)...
CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
CVE-2026-102282: Incorrect Permission Assignment for Critical Resource
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
The vulnerabilities of the `extractAllTo()` and `extractEntryTo()` functions in the Node.js library for working with zip files, Adm-zip, allow attackers to escalate their privileges.
The vulnerability of the extractAllTo and extractEntryTo functions in the Node.js library for working with zip files, Adm-zip, is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to increase their privileges...
adm-zip_LPE-PoC
CVE-2026-102282: adm-zip Local Privilege Escalation via SUID Preservation Description adm-zip is an established, pure-JavaScript ZIP archive library for Node.js with over 20 million weekly downloads across the npm ecosystem. It is widely integrated into CI/CD pipelines, container build workflows,...
POC-CVE-2026-102282
CVE-2026-102282 — adm-zip setuid/setgid preservation during extraction Incorrect permission assignment in the npm package adm-zip. Extraction can keep setuid, setgid, and sticky bits from an untrusted zip when keepOriginalPermission is enabled, allowing a root-owned setuid executable to be plante...
