CVE-2026-102282High· 7.1▾ MidnightPoC availableadm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPer…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
2 GitHub repos
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.2%
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode 04755. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
adm-zip <= 0.6.0Patched in:
adm-zip 0.6.1Source: https://github.com/advisories/GHSA-j5f4-cc29-5x44
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77301High· 7.5adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js
CVE-2026-92000High· 7.5adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size
CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
GHSA-c6fg-446q-cg94Medium· 5.3adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
GHSA-8238-w5pm-2374High· 7.5adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
GHSA-p634-w6r4-rjp2Medium· 5.9adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content