{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9550add6-aa56-5445-952b-7b3eeff3441d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.4.4-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4", "version": "0.4.4-tuxcare.4", "pedigree": { "ancestors": [ { "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.4.4", "type": "library", "version": "0.4.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-1002204", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:42ecdf87-465f-5f49-a9f2-460adefd363f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1002204 is fixed in version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "CVE-2023-0842", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:a35fb18c-c6a8-5893-a955-efc83c30e267", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-0842 is a false positive for adm-zip 0.4.4-tuxcare.4. false_positive \u2014 CVE-2023-0842 is a wrong-project match. The advisory concerns xml2js (an XML parsing library), while the target repository is adm-zip version 0.4.4-tuxcare.1 (a ZIP compression library). These are completely different products with no code relationship." } }, { "id": "CVE-2026-102282", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:aecd8519-bd1c-5761-9e54-36e03b5a9f0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102282 does not affect version 0.4.4-tuxcare.4 of adm-zip. not_affected \u2014 Version 0.4.4 predates the vulnerable feature entirely. The `keepOriginalPermission` parameter and `fileAttr` getter that enable the vulnerability were introduced in version 0.5.16+. In version 0.4.4, extraction methods (`extractAllTo`, `extractEntryTo`) never read or apply Unix permission bits from zip entries\u2014all extracted files receive default permissions (0o666). While external attributes a...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114102", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:38f1b40c-2aa5-594b-8a37-ccc9cc1b675f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114102 affects version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "CVE-2026-114104", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:60fcb525-b495-5623-ba9f-7a6bdd9a14d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114104 affects version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "CVE-2026-114105", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:deaa6489-b535-501e-a3e1-e6f4cd52925b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114105 does not affect version 0.4.4-tuxcare.4 of adm-zip. not_affected \u2014 adm-zip 0.4.4 is not affected by CVE-2026-114105. The vulnerability requires the keepOriginalPermission feature, which does not exist in version 0.4.4. While ZIP external file attributes containing setuid/setgid bits are read from archives, no code path applies these attributes to extracted files. All files are extracted with default permission 0666, preventing privilege escalation via setuid/s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-116137", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:74bb1a09-3e97-569e-a9d9-af7f341e06d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116137 affects version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "CVE-2026-39244", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:de848c03-0b0a-53ae-8345-988ccff76a83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-39244 is fixed in version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "CVE-2026-77301", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:257d140a-0c26-51f8-b433-d587d652fe22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-77301 is fixed in version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "CVE-2026-92000", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:40661ef3-c17f-5ff3-89c7-47281a0cc6a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92000 affects version 0.4.4-tuxcare.4 of adm-zip, and is fixed in 0.4.4-tuxcare.5." } }, { "id": "GHSA-8238-w5pm-2374", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:b18a3111-ed0e-53ce-a3d7-540c24f08088", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8238-w5pm-2374 is fixed in version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "GHSA-c6fg-446q-cg94", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:53a7b002-cb2c-544c-91ab-0694326540f6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6fg-446q-cg94 affects version 0.4.4-tuxcare.4 of adm-zip, and is fixed in 0.4.4-tuxcare.5." } }, { "id": "GHSA-p634-w6r4-rjp2", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:79bcd8ca-c822-50be-80a6-fd9719dc5753", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-p634-w6r4-rjp2 is fixed in version 0.4.4-tuxcare.4 of adm-zip." } }, { "id": "GHSA-rcw4-f5rp-g42v", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ], "bom-ref": "urn:uuid:07ba2bf9-37ab-581b-a958-ce4f61631d6b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-rcw4-f5rp-g42v affects version 0.4.4-tuxcare.4 of adm-zip." } } ], "dependencies": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.4" } ] }