CVE-2026-102282
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
adm-zip prior to 0.6.1 applies Unix permission bits from a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and never filters out setuid/setgid/sticky bits. A crafted zip can produce an extracted binary with mode 04755, leading to attacker code execution as root when extraction runs as root.
Risk Assessment
An attacker can supply a crafted ZIP archive that, when extracted as root, creates a setuid file, enabling later execution of attacker code with root privileges by a lesser-privileged user. In Docker, CI, and privileged install environments, the privilege escalation risk is critical.
Recommendation
Update adm-zip to version 0.6.1. Until then, avoid using keepOriginalPermission=true or filter out setuid/setgid/sticky bits before extraction.
Other vulnerabilities in adm-zip
See all- CVE-2026-114105Medium
adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Crafted zip external file attributes pass unmasked into chmod.
- CVE-2026-114104Medium
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. getEntry() returns the last duplicate while extractAllTo() writes the first.
- CVE-2026-114103Medium
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
- CVE-2026-114102High
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
- CVE-2026-77301High
A vulnerability in the adm-zip library (JavaScript) prior to 0.6.1 affects getData() in zipEntry.js, which trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing excessive memory consumption before CRC validation reports an error. Applications reading entries from untrusted archives can be terminated by the OS or suffer memory exhaustion.
- CVE-2026-92000High
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
- CVE-2026-76845Medium
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines.
- CVE-2026-39244High
The adm-zip library before version 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. An attacker can create a small ZIP file (about 120 bytes) declaring an uncompressed size of 4 GB, leading to memory allocation amplification of over 33 million to 1, causing a process crash.
Original NVD description (English source)
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS