{"id":"EUVD-2026-92493","revision":"dec029a3d08d47fc82d259bfc8b1ee83","records":[{"revision":"dec029a3d08d47fc82d259bfc8b1ee83","observedAt":"2026-11-05T03:54:11.679+00:00","statement":{"source":"euvd","id":"EUVD-2026-92493","aliases":["CVE-2026-102282","GHSA-j5f4-cc29-5x44"],"title":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermis…","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":7.1,"severity":null}],"references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92493","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 5, 2026, 5:00:00 PM","dateUpdated":"Oct 7, 2026, 8:53:52 PM"},"relatedAdvisories":[{"id":"RHSA-2026:92510","title":"Red Hat Security Advisory: RHOAI 3.4.6 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2023-54404","CVE-2026-11822","CVE-2026-11824","CVE-2026-13717","CVE-2026-16221","CVE-2026-17106","CVE-2026-18446","CVE-2026-25681","CVE-2026-26007","CVE-2026-27136","CVE-2026-33814","CVE-2026-33818","CVE-2026-39821","CVE-2026-39834","CVE-2026-41178","CVE-2026-42502","CVE-2026-45819","CVE-2026-45820","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57516","CVE-2026-59951","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-67312","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69097","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-77301","CVE-2026-78679","CVE-2026-82397","CVE-2026-83663","CVE-2026-84375","CVE-2026-84445","CVE-2026-85393","CVE-2026-85525","CVE-2026-87018","CVE-2026-90711","CVE-2026-91990","CVE-2026-92599","CVE-2026-93690","CVE-2026-93749","CVE-2026-94637","CVE-2026-96640","CVE-2026-96643","CVE-2026-96644","CVE-2026-96778","CVE-2026-96804","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102271","CVE-2026-102272","CVE-2026-102276","CVE-2026-102278","CVE-2026-102282","CVE-2026-104150","CVE-2026-104851","CVE-2026-105922","CVE-2026-106445","CVE-2026-106446","CVE-2026-109156","CVE-2026-109383","CVE-2026-109527","CVE-2026-109829","CVE-2026-109869","CVE-2026-109956","CVE-2026-110856","CVE-2026-110857","CVE-2026-110858","CVE-2026-110859","CVE-2026-111064","CVE-2026-111066","CVE-2026-111497","CVE-2026-112390","CVE-2026-112391","CVE-2026-112392","CVE-2026-112397","CVE-2026-112399","CVE-2026-112400","CVE-2026-112402","CVE-2026-112404","CVE-2026-112405","CVE-2026-112893","CVE-2026-112894","CVE-2026-112895","CVE-2026-112896","CVE-2026-112897","CVE-2026-112940","CVE-2026-114145"]},{"id":"RHSA-2026:86675","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-77037","CVE-2026-77301","CVE-2026-82333","CVE-2026-90711","CVE-2026-92955","CVE-2026-93749","CVE-2026-102282","CVE-2026-102990","CVE-2026-106501","CVE-2026-106503"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-92493","identifiers":["EUVD-2026-92493","CVE-2026-102282","GHSA-j5f4-cc29-5x44"]},"retained":false,"historicalAffected":[]}],"coverage":[]}