{"id":"CVE-2026-102282","title":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js","summary":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPer…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-732","CWE-278"],"vendor":"cthackers","product":"adm-zip","affected":["adm-zip < 0.6.1"],"patched":["adm-zip 0.6.1"],"published":"2026-10-05","updated":"2026-10-07","sourceUpdated":"2026-10-07T21:17:07.297","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102282","references":[{"url":"https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","label":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","label":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","label":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-j5f4-cc29-5x44"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102282.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-102282"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545998"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102282"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102282"},{"url":"https://access.redhat.com/errata/RHSA-2026:86675"}],"tags":["nvd","cve.org","exploit-available","ghsa","npm","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-07T20:53:29.301313Z"},"epss":0.00199,"epssPercentile":0.09687,"exploits":{"github":2,"githubRepos":["https://github.com/x86byte/adm-zip_LPE-PoC","https://github.com/Ahmed-Elmahgob/POC-CVE-2026-102282"],"checkedAt":"2026-10-27T16:53:21.738Z"},"aliases":["GHSA-j5f4-cc29-5x44"],"ecosystem":"npm","ingestedAt":"2026-09-29T18:42:35.829Z","slug":"CVE-2026-102282","body":"## Overview\n\nadm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-102282)\n\nAffected packages:\n\n- `adm-zip <= 0.6.0`\n\nPatched in:\n\n- `adm-zip 0.6.1`\n\nSource: https://github.com/advisories/GHSA-j5f4-cc29-5x44\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Fuse 7, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 8, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102282.json)\n- **RHSA-2026:86675** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86675)","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":214535,"id":"CVE-2026-102282","ts":1790874074566,"field":"exploit_available","old":"false","new":"true"}]}