CVE-2026-102282
- Source
- https://cve.org/CVERecord?id=CVE-2026-102282
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102282.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-102282
- Aliases
- Downstream
CLEANSTART (1)
CLSA (6)
ECHO (1)
MINI (14)
ROOT (1)
- Published
- 2026-10-05T17:00:00Z
- Modified
- 2026-10-21T02:55:04Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
- Details
-
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via
fs.chmodSync()whenkeepOriginalPermission=trueis passed toextractAllTo()/extractEntryTo()— and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode04755. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-732" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102282.json" }- References
-
- https://github.com/cthackers/adm-zip/releases/tag/v0.6.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102282.json
- https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44
- https://nvd.nist.gov/vuln/detail/CVE-2026-102282
- https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87
Affected packages
Git / github.com/cthackers/adm-zip
Affected ranges
- Type
- GIT
- Repo
- https://github.com/cthackers/adm-zip
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "0.6.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "6a63c339b83c52915483efacda517660a7a7bf87" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.6.1", "range": [ { "fixed": "cb2cf9ba4c7c865db426e2de1997cb41194d9872" } ], "source": "REFERENCES_TAG" } ] }