{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9115b389-3e4f-57d1-b8b3-3f20ba89d222", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.4.4-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3", "version": "0.4.4-tuxcare.3", "pedigree": { "ancestors": [ { "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.4.4", "type": "library", "version": "0.4.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-1002204", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:4853e455-0dc7-5e25-98b2-767d04508674", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1002204 is fixed in version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "CVE-2023-0842", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:c39bed31-fd83-537e-8f84-705618b46825", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-0842 is a false positive for adm-zip 0.4.4-tuxcare.3. false_positive \u2014 CVE-2023-0842 is a wrong-project match. The advisory concerns xml2js (an XML parsing library), while the target repository is adm-zip version 0.4.4-tuxcare.1 (a ZIP compression library). These are completely different products with no code relationship." } }, { "id": "CVE-2026-102282", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:78b49735-dfd7-567c-8fb0-520da6761a59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102282 does not affect version 0.4.4-tuxcare.3 of adm-zip. not_affected \u2014 Version 0.4.4 predates the vulnerable feature entirely. The `keepOriginalPermission` parameter and `fileAttr` getter that enable the vulnerability were introduced in version 0.5.16+. In version 0.4.4, extraction methods (`extractAllTo`, `extractEntryTo`) never read or apply Unix permission bits from zip entries\u2014all extracted files receive default permissions (0o666). While external attributes a...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114102", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:6b2dffdc-b1b7-5bac-b672-19701aaa54f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114102 affects version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "CVE-2026-114104", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:b546c0ca-c582-5341-81d6-e2c814246b08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114104 affects version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "CVE-2026-114105", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:f613c884-eed4-5488-b25f-cd2c96472fbd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114105 does not affect version 0.4.4-tuxcare.3 of adm-zip. not_affected \u2014 adm-zip 0.4.4 is not affected by CVE-2026-114105. The vulnerability requires the keepOriginalPermission feature, which does not exist in version 0.4.4. While ZIP external file attributes containing setuid/setgid bits are read from archives, no code path applies these attributes to extracted files. All files are extracted with default permission 0666, preventing privilege escalation via setuid/s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-116137", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:6592fcfa-fdda-5f1b-ba42-c298c03403b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116137 affects version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "CVE-2026-39244", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:bbafdac5-a324-51f6-ae49-ac625d78a8b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-39244 is fixed in version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "CVE-2026-77301", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:18879723-1c19-595e-ab53-7f0f1a05d797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-77301 is fixed in version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "CVE-2026-92000", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:f1acffed-0b07-5a01-86da-ed1b982ee029", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92000 affects version 0.4.4-tuxcare.3 of adm-zip, and is fixed in 0.4.4-tuxcare.5." } }, { "id": "GHSA-8238-w5pm-2374", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:54834574-2d51-55ed-a026-6bd7a254de7e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8238-w5pm-2374 is fixed in version 0.4.4-tuxcare.3 of adm-zip." } }, { "id": "GHSA-c6fg-446q-cg94", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:e04be569-044c-5c70-9ff0-6ecd9e4de3ca", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6fg-446q-cg94 affects version 0.4.4-tuxcare.3 of adm-zip, and is fixed in 0.4.4-tuxcare.5." } }, { "id": "GHSA-p634-w6r4-rjp2", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:309eba50-21a3-5444-8b14-e0bb658f54e7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p634-w6r4-rjp2 affects version 0.4.4-tuxcare.3 of adm-zip, and is fixed in 0.4.4-tuxcare.4." } }, { "id": "GHSA-rcw4-f5rp-g42v", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ], "bom-ref": "urn:uuid:106c710f-a05b-541d-9502-03e3b2112a26", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-rcw4-f5rp-g42v affects version 0.4.4-tuxcare.3 of adm-zip." } } ], "dependencies": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.3" } ] }