CVE-2026-76845

adm-zip versions 0.5.9 through 0.6.0 suffer from an arbitrary file overwrite via symbolic link following at the extraction destination. The root cause lies in Utils.sanitize (in util/utils.js), which compares only the string form of an archive entry name against the resolved extraction root, and ...

CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

PT-2026-79053

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.5 Description The DirectoryPromptRegistry.set function in src/banks/registries/directory.py fails to perform canonicalization or containment validation when interpolating Prompt.name and Prompt.version values into a...