{"items":[{"id":"NVI-00014185","kind":"vulnerability","title":"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vwc7-r8mq-g2x9","CVE-2026-76845"],"plain_summary":"GitHub lists this reviewed advisory for adm-zip. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0607f569b28fb852336c3edf717b6e9c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-08T21:20:42.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5692f3134a24a8669cb40e67f2dd3f67"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.171%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.06482. Missing scores are unknown.","source_id":"sr-0607f569b28fb852336c3edf717b6e9c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5692f3134a24a8669cb40e67f2dd3f67","url":"https://github.com/advisories/GHSA-vwc7-r8mq-g2x9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vwc7-r8mq-g2x9","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:12.705Z"},{"id":"sr-0607f569b28fb852336c3edf717b6e9c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-76845","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:45:16.081Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5692f3134a24a8669cb40e67f2dd3f67"],"technology":"adm-zip","known_exclusions":[],"conditions_summary":"adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, \"w\", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.","public_affected_ranges":[">= 0.5.9, <= 0.6.0"]}],"null_published_at":"2026-11-04T10:04:41.549Z","source_updated_at":"2026-09-08T21:20:42.000Z","source_disclosed_at":"2026-08-24T15:31:51.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T22:54:12.705Z"},{"id":"NVI-00014185","kind":"vulnerability","title":"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vwc7-r8mq-g2x9","CVE-2026-76845"],"plain_summary":"GitHub lists this reviewed advisory for adm-zip. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5692f3134a24a8669cb40e67f2dd3f67"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-08T21:20:42.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5692f3134a24a8669cb40e67f2dd3f67"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5692f3134a24a8669cb40e67f2dd3f67","url":"https://github.com/advisories/GHSA-vwc7-r8mq-g2x9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vwc7-r8mq-g2x9","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:12.705Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5692f3134a24a8669cb40e67f2dd3f67"],"technology":"adm-zip","known_exclusions":[],"conditions_summary":"adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, \"w\", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.","public_affected_ranges":[">= 0.5.9, <= 0.6.0"]}],"null_published_at":"2026-11-02T10:00:37.221Z","source_updated_at":"2026-09-08T21:20:42.000Z","source_disclosed_at":"2026-08-24T15:31:51.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:12.705Z"}],"next_cursor":null,"snapshot_revision":"42594"}