Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-102282 · GHSA-j5f4-cc29-5x44

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Risk score
48/100
CVSS
7.1 v3.1
Exploit chance (30 days)
0.1%
Published
29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and it never filters the …
Affected
adm-zip (npm) <= 0.6.0
Fix
Upgrade adm-zip to 0.6.1 or later.
Exploitation
No known exploitation

Story map

Story map: adm-zipTHE FLAWSTHE FIXCVE-2026-102282Adm-zip extraction preservesSUID/SGID bits fromuntrusted ZIPs -> local…CVSS 7.1 · EPSS 0%GHSA-8238-w5pm-2374Unhandled error event in asyncDEFLATE decompressioncrashes Node.js process (DoS)CVSS 7.5GHSA-rcw4-f5rp-g42vDecompression-bombprotection (fix forCVE-2026-39244) can be…CVSS 7.5GHSA-p634-w6r4-rjp2Duplicate ZIP entry names:getEntry() and extractAllTo()resolve to different contentCVSS 5.9Upgrade adm-zip0.6.1or later on your release lineWho is exposedadm-zip (npm) <= 0.6.0AMBER · PATCH THIS WEEKadm-zipDenial of Service in adm-zip'sasync decompression API allowsan unauthenticated attacker tocrash the entire Node.js hostprocess by supplying a singlemalformed ZIP file. Affectedpackage: adm-zip Affected…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-732 (CWE-732)37 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

adm-zip: Amber, patch this week. Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Affected package: adm-zip Affected versions: at least 0.6.0 (current latest); likely all versions containing the current inflateAsync implementati…

The flaws

  • CVE-2026-102282: Adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation (CVSS 7.1 · EPSS 0%)
  • GHSA-8238-w5pm-2374: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS) (CVSS 7.5)
  • GHSA-rcw4-f5rp-g42v: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 (CVSS 7.5)
  • GHSA-p634-w6r4-rjp2: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content (CVSS 5.9)

The fix

Upgrade adm-zip: 0.6.1 or later on your release line

Who is exposed: adm-zip (npm) <= 0.6.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 7.1 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
adm-zipnpm<= 0.6.00.6.1

References

Original description

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.

Last activity 29 Sep 2026. Patch Forecast updates every hour.