Security
فارسی
All products

adm-zip

npm · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationCVE-2026-102282 · GHSA-J5F4-CC29-5X44 adm-zipRed Hat Build of Podman Desktop/rh-podman-desktop npmRed Hat High Fix reported
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different contentGHSA-P634-W6R4-RJP2 adm-zip npm Medium Fix reported
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() pathGHSA-C6FG-446Q-CG94 adm-zip npm Medium Fix reported
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)GHSA-8238-W5PM-2374 adm-zip npm High Fix reported
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0CVE-2026-92000 · GHSA-RCW4-F5RP-G42V adm-zipRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat High Fix reported
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)CVE-2026-77301 · GHSA-7Q85-XJ36-VMFC adm-zipRed Hat Advanced Cluster Management for Kubernetes 2/redhat-user-workloads/volsync-0-12 npmRed Hat High Fix reported
adm-zip: Crafted ZIP file triggers 4GB memory allocationCVE-2026-39244 · GHSA-XCPC-8H2W-3J85 adm-zipRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-operator-bundle npmRed Hat High Fix reported
adm-zip extraction follows destination symlinks, allowing arbitrary file overwriteCVE-2026-76845 · GHSA-VWC7-R8MQ-G2X9 adm-zipRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-operator-bundle npmRed Hat Medium No fix reported
Arbitrary File Write in adm-zipCVE-2018-1002204 · GHSA-3V6H-HQM4-2RG6 adm-zipRed Hat Mobile Application Platform 4/nodejs-adm-zip npmRed Hat Medium Fix reported