Answer in brief
CVE-2026-102282 records a High severity (CVSS 7.1) vulnerability in adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation. The current sources do not mark it as known exploited. The current feed maps cthackers/adm-zip (generic), adm-zip (npm), adm-zip (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps cthackers/adm-zip (generic), adm-zip (npm), adm-zip (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| cthackers/adm-zipgeneric | <0.6.1 | 0.6.1 |
| adm-zipnpm | <=0.6.0 | 0.6.1 |
| adm-zipnpm | >=0 <0.6.1 | 0.6.1 |
Published upstream
Oct 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 29, 2026
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.
Quoted source text, attributed separately from HOL analysis.