Linux Distros Unpatched Vulnerability : CVE-2026-102282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm- zip applies the Unix permission bits stored in a zip...

CVE-2026-102282

The adm-zip Node.js library (prior to 0.6.1 ) contains a vulnerability where it preserves SUID , SGID , and sticky bits from untrusted ZIP archives when the keepOriginalPermission=true flag is enabled. Specifically, the fileAttr property in headers/entryHeader.js uses an incorrect bitmask (0xfff)...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282: Incorrect Permission Assignment for Critical Resource

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

GHSA-J5F4-CC29-5X44 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

PT-2026-102974

Name of the Vulnerable Software and Affected Versions adm-zip version 0.6.0 Description An issue exists where the software applies Unix permission bits from a zip entry directly to an extracted file using the fs.chmodSync function when the keepOriginalPermission flag is set to true in the...

CVE-2023-23939

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This...

CVE-2023-23939: Incorrect Permission Assignment for Critical Resource

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This...