---
id: CVE-2026-102282
title: >-
  adm-zip is a JavaScript library for creating and extracting ZIP archives in
  Node.js
summary: >-
  adm-zip is a JavaScript library for creating and extracting ZIP archives in
  Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a
  zip entry directly to the extracted file via `fs.chmodSync()` when
  `keepOriginalPer…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-732
  - CWE-278
vendor: cthackers
product: adm-zip
affected:
  - adm-zip < 0.6.1
patched:
  - adm-zip 0.6.1
published: '2026-10-05'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:17:07.297'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102282'
references:
  - url: >-
      https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87
    label: security-advisories@github.com
  - url: 'https://github.com/cthackers/adm-zip/releases/tag/v0.6.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44
    label: security-advisories@github.com
  - url: >-
      https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-j5f4-cc29-5x44'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102282.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-102282'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2545998'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102282'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102282'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86675'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-07T20:53:29.301313Z'
epss: 0.00199
epssPercentile: 0.09687
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/x86byte/adm-zip_LPE-PoC'
    - 'https://github.com/Ahmed-Elmahgob/POC-CVE-2026-102282'
  checkedAt: '2026-10-27T16:53:21.738Z'
aliases:
  - GHSA-j5f4-cc29-5x44
ecosystem: npm
ingestedAt: '2026-09-29T18:42:35.829Z'
---

## Overview

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-102282)

Affected packages:

- `adm-zip <= 0.6.0`

Patched in:

- `adm-zip 0.6.1`

Source: https://github.com/advisories/GHSA-j5f4-cc29-5x44

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Fuse 7, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 8, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102282.json)
- **RHSA-2026:86675** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86675)