{"id":"EUVD-2026-92493","enisaUuid":"5d419f99-5d94-340f-94fb-01ef17392457","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission\u003dtrue` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker\u0027s code into a root execution. Version 0.6.1 fixes the issue.","datePublished":"Oct 5, 2026, 5:00:00 PM","dateUpdated":"Oct 7, 2026, 8:53:52 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44\nhttps://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87\nhttps://github.com/cthackers/adm-zip/releases/tag/v0.6.1\n","aliases":"CVE-2026-102282\nGHSA-j5f4-cc29-5x44\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"99590a72-3c76-360e-963d-93d52371a5fb","product":{"name":"adm-zip","vendor":{"name":"Node.js"}},"product_version":"\u003c 0.6.1"}],"enisaIdVendor":[{"id":"968c6600-cf3e-3f60-8afe-b4820d202da6","vendor":{"name":"cthackers"}}],"enisaIdVulnerability":[{"id":"16748e13-dff3-3cec-aad4-3045c051351b","vulnerability":{"id":"CVE-2026-102282","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission\u003dtrue` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker\u0027s code into a root execution. Version 0.6.1 fixes the issue.","datePublished":"Oct 5, 2026, 5:00:00 PM","dateUpdated":"Oct 7, 2026, 8:53:52 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44\nhttps://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87\nhttps://github.com/cthackers/adm-zip/releases/tag/v0.6.1\n","enisa_id":"EUVD-2026-92493\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 27, 2026, 7:15:40 AM","vulnerabilityProduct":[{"id":"34c5fc99-ee65-36f0-afd8-3243eb720cab","product":{"name":"adm-zip","vendor":{"name":"Node.js"}},"product_version":"\u003c 0.6.1"}],"vulnerabilityVendor":[{"id":"6712337c-e50e-35c4-9a8f-4ec4f5b9cff1","vendor":{"name":"cthackers"}}]}},{"id":"af1336ab-80c6-3961-a1ba-acd97fbac071","vulnerability":{"id":"GHSA-j5f4-cc29-5x44","description":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","datePublished":"Sep 29, 2026, 6:24:57 PM","dateUpdated":"Sep 29, 2026, 6:24:57 PM","baseScore":0.0,"references":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44\nhttps://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87\nhttps://github.com/cthackers/adm-zip\nhttps://github.com/cthackers/adm-zip/releases/tag/v0.6.1\n","enisa_id":"EUVD-2026-92493\n","aliases":"CVE-2026-102282\nGHSA-j5f4-cc29-5x44\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"f69aa851-d624-3aff-b13d-51e91ecca934","advisory":{"id":"RHSA-2026:86675","description":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Oct 21, 2026, 7:25:30 AM","dateUpdated":"Oct 27, 2026, 4:24:54 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:86675\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86675.json\n","aliases":"CVE-2026-77037\nCVE-2026-77301\nCVE-2026-82333\nCVE-2026-90711\nCVE-2026-92955\nCVE-2026-93749\nCVE-2026-102282\nCVE-2026-102990\nCVE-2026-106501\nCVE-2026-106503\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"6bf7bb77-a70e-38fc-a024-56588bc1f6ad","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64","vendor":{"name":"Red Hat"}}},{"id":"73a82987-c21f-3856-ac3f-ca13fd349699","product":{"name":"Red Hat Ansible Automation Platform 2.2","vendor":{"name":"Red Hat"}}}]}}]}