{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:381342a4-cf1e-58ae-98c8-c64976285d55",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "adm-zip",
      "purl": "pkg:npm/adm-zip@0.4.16-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2",
      "version": "0.4.16-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "adm-zip",
            "purl": "pkg:npm/adm-zip@0.4.16",
            "type": "library",
            "version": "0.4.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-102282",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee13bc9d-e227-5436-af7b-f2838eeff467",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-102282 does not affect version 0.4.16-tuxcare.2 of adm-zip. not_affected \u2014 Version 0.4.16 is not affected by CVE-2026-102282. The vulnerability requires the `keepOriginalPermission` feature and `fileAttr` getter, which were introduced in commit 2b2a1d7 (September 2021). This commit is not in 0.4.16's ancestry. The target always extracts files with default permission 0o666, completely ignoring zip entry permission bits. The attack chain from zip attributes to files wit...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-114102",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a30155a6-7f5c-5aec-8aa3-364c8c4a2394",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-114102 affects version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "CVE-2026-114104",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:26173ca6-27f7-5a3f-a78c-5404fa95c632",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-114104 affects version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "CVE-2026-114105",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:02e64693-8254-5b80-8e74-b6ead9e83fa0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114105 does not affect version 0.4.16-tuxcare.2 of adm-zip. not_affected \u2014 Version 0.4.16-tuxcare.3 is NOT AFFECTED by CVE-2026-114105. The vulnerability requires the `keepOriginalPermission` feature, which was introduced in v0.5.7 (commit 2b2a1d7, 2021-09-26) and fixed in v0.6.1 (commit 6a63c33, 2026-09-11). Version 0.4.16 predates this feature entirely. In 0.4.16, extraction functions (extractAllTo, extractEntryTo, extractAllToAsync) call Utils.writeFileTo() WITHOUT...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-116137",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a54f18a5-f2f6-515f-98b3-51407ee5a554",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-116137 affects version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "CVE-2026-39244",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d6b71763-f07e-520f-b064-d9b080ef44f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39244 is fixed in version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "CVE-2026-77301",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a830720c-b005-5ae0-85a4-23ce80b17027",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-77301 is fixed in version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "CVE-2026-92000",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fe1b6280-36db-53ef-a42e-9f551a30c8d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-92000 affects version 0.4.16-tuxcare.2 of adm-zip, and is fixed in 0.4.16-tuxcare.3."
      }
    },
    {
      "id": "GHSA-8238-w5pm-2374",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e86ce184-87ca-538a-a78a-a7a4b5f4c6df",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-8238-w5pm-2374 is fixed in version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "GHSA-c6fg-446q-cg94",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d92dc44b-7746-595f-b5e0-dac903f52765",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6fg-446q-cg94 affects version 0.4.16-tuxcare.2 of adm-zip, and is fixed in 0.4.16-tuxcare.3."
      }
    },
    {
      "id": "GHSA-p634-w6r4-rjp2",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cae5ff03-cad6-56ef-a0b3-cd70bec67e99",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-p634-w6r4-rjp2 is fixed in version 0.4.16-tuxcare.2 of adm-zip."
      }
    },
    {
      "id": "GHSA-rcw4-f5rp-g42v",
      "affects": [
        {
          "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cfda03b0-9932-5dec-94f3-c723ab9d80e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-rcw4-f5rp-g42v affects version 0.4.16-tuxcare.2 of adm-zip."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/adm-zip@0.4.16-tuxcare.2"
    }
  ]
}