CVE-2026-102282

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

The vulnerabilities of the `extractAllTo()` and `extractEntryTo()` functions in the Node.js library for working with zip files, Adm-zip, allow attackers to escalate their privileges.

The vulnerability of the extractAllTo and extractEntryTo functions in the Node.js library for working with zip files, Adm-zip, is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-76845: Improper Link Resolution Before File Access

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...