CVE-2026-102282: adm-zip Privilege Escalation Vulnerability

CVE-2026-102282 Overview

CVE-2026-102282 affects adm-zip, a JavaScript library for creating and extracting ZIP archives in Node.js. Versions prior to 0.6.1 apply Unix permission bits stored in zip entries directly to extracted files via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo() or extractEntryTo(). The library fails to filter setuid, setgid, and sticky bits from attacker-controlled archive metadata. A crafted zip can produce an extracted binary with mode 04755, planting a setuid-root executable when extraction runs as root. Version 0.6.1 remediates the flaw by masking permissions to the standard 0o777 bits.

Critical Impact
An attacker-supplied zip archive can plant a setuid-root binary during extraction in root contexts such as Docker builds, CI runners, or privileged install scripts, enabling local privilege escalation when a lesser-privileged user executes the extracted file.

Affected Products

adm-zip npm package versions prior to 0.6.1
Node.js applications using extractAllTo() or extractEntryTo() with keepOriginalPermission=true
Container builds, CI/CD runners, and installer scripts that extract archives as root

Discovery Timeline

2026-10-05 - CVE-2026-102282 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102282

Vulnerability Analysis

The flaw is an [CWE-732] Incorrect Permission Assignment for Critical Resource. The adm-zip library stores Unix permission bits in the upper 16 bits of the external attributes field of each zip entry. When keepOriginalPermission=true, the extraction routine reads these bits and applies them verbatim to the extracted file using fs.chmodSync().

The original implementation extracted 12 bits (0xfff), which includes the setuid (0o4000), setgid (0o2000), and sticky (0o1000) bits. These bits originate entirely from attacker-controlled archive metadata. When extraction runs with root privileges, the operating system honors the setuid bit on the resulting file, producing a root-owned executable that elevates privileges on execution.

The vulnerability is particularly impactful in Docker image builds, CI pipelines, and postinstall scripts where extraction routinely runs as uid 0 and the resulting filesystem is later accessed by non-root service accounts.

Root Cause

The root cause is the absence of a permission mask when transferring archive-declared file modes to the filesystem. The library trusts archive metadata as if it were operator-supplied configuration. No validation distinguishes benign permission bits from privilege-granting special bits.

Attack Vector

An attacker crafts a zip archive containing an executable payload with its external attributes field set to encode mode 04755. The attacker delivers the archive through any ingestion path consumed by a privileged adm-zip extraction, such as a build artifact, a package tarball, or a user-supplied upload processed by a root-level worker. After extraction, a lower-privileged user invokes the planted binary, which executes with root UID.

javascript

// Security patch in headers/entryHeader.js
// get Unix file permissions
get fileAttr() {
-    return (_attr || 0) >> 16 & 0xfff;
+    // Mask to the 9 rwxrwxrwx bits only. The setuid (0o4000), setgid
+    // (0o2000) and sticky (0o1000) bits are attacker-controlled archive
+    // metadata; preserving them on extraction (keepOriginalPermission)
+    // lets a crafted zip plant a setuid-root binary when extracting as
+    // root, a local privilege escalation (GHSA-679w-jf3m-wh39).
+    return ((_attr || 0) >> 16) & 0o777;
},

Source: GitHub Commit 6a63c33

Detection Methods for CVE-2026-102282

Indicators of Compromise

Files on disk owned by root with the setuid bit set (-rwsr-xr-x) in directories populated by application extraction routines
Unexpected adm-zip versions below 0.6.1 referenced in package-lock.json or yarn.lock
Build logs showing extractAllTo or extractEntryTo invocations with keepOriginalPermission=true executing under root

Detection Strategies

Scan container images and extracted filesystem trees for setuid or setgid binaries that were not part of the base OS package set
Perform software composition analysis against dependency manifests to identify adm-zip versions earlier than 0.6.1
Audit source code for calls to extractAllTo or extractEntryTo that pass keepOriginalPermission=true

Monitoring Recommendations

Alert on chmod syscalls that set mode bits containing 0o4000 or 0o2000 from Node.js processes running as root
Monitor execution of setuid binaries from non-standard paths such as /tmp, /var/tmp, or application working directories
Log and review all archive extraction operations performed during container image builds and npm install lifecycle scripts

How to Mitigate CVE-2026-102282

Immediate Actions Required

Upgrade adm-zip to version 0.6.1 or later across all projects and transitive dependencies
Audit container images and application directories for existing setuid files created by prior extractions and remove or re-chmod them
Review all code paths that call extractAllTo or extractEntryTo and set keepOriginalPermission=false unless explicitly required

Patch Information

Version 0.6.1 masks extracted permissions to 0o777, stripping the setuid, setgid, and sticky bits. See the GitHub Release v0.6.1 and the GitHub Security Advisory GHSA-j5f4-cc29-5x44 for complete remediation details.

Workarounds

Avoid passing keepOriginalPermission=true to extraction functions when the extracting process has elevated privileges
Perform archive extraction as a dedicated non-root user in Docker and CI environments
Mount extraction target directories with the nosuid option to prevent the kernel from honoring the setuid bit on extracted files

bash

# Upgrade adm-zip to the patched version
npm install adm-zip@^0.6.1

# Mount extraction target with nosuid as a defense-in-depth control
mount -o remount,nosuid /var/app/extracted

# Identify existing setuid files in application directories
find /var/app -xdev -type f -perm -4000 -ls