CVE-2026-102282 cthackers CVE debrief

Who should care

Node.js developers and administrators using adm-zip, especially those in environments like Docker builds, CI runners, and privileged install steps, should verify and update affected systems, and monitor for suspicious activity. This includes reviewing and updating affected systems, checking for potential local privilege escalation, and ensuring that compensating controls are in place for exposed systems.

Why it matters

CVE-2026-102282 is a high-severity vulnerability in the adm-zip library for Node.js that allows for local privilege escalation. Developers and administrators should verify and update affected systems, and monitor for suspicious activity.

• Potential local privilege escalation
• Need to verify and update affected systems
• Possible exposure in Docker builds, CI runners, and privileged install steps

Technical summary

The adm-zip library for Node.js did not properly handle Unix permission bits when extracting ZIP archives, allowing for local privilege escalation. Specifically, it preserved SUID/SGID bits from untrusted ZIPs, which can lead to potential local privilege escalation in environments like Docker builds, CI runners, and privileged install steps. The vulnerability is addressed in version 0.6.1 of the adm-zip library, which properly filters out these bits during extraction. Developers and administrators should verify and update affected systems.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 0.6.1 or later
• Review and update affected systems
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in adm-zip, a JavaScript library for creating and extracting ZIP archives in Node.js. The vulnerability allows for local privilege escalation by preserving SUID/SGID bits from untrusted ZIPs. Evidence is based on CVE Program records and source item details. Defenders should verify affected systems, review official advisories, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.