{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4f1829bd-b4cf-521f-9c66-a0c2614b3f10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.4.4-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5", "version": "0.4.4-tuxcare.5", "pedigree": { "ancestors": [ { "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.4.4", "type": "library", "version": "0.4.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-1002204", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:d1832a90-ce63-550b-a267-d1f6ea49d996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1002204 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "CVE-2023-0842", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:e3976538-76d0-504a-8b09-691ab5757490", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-0842 is a false positive for adm-zip 0.4.4-tuxcare.5. false_positive \u2014 CVE-2023-0842 is a wrong-project match. The advisory concerns xml2js (an XML parsing library), while the target repository is adm-zip version 0.4.4-tuxcare.1 (a ZIP compression library). These are completely different products with no code relationship." } }, { "id": "CVE-2026-102282", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:ed1a3bdd-d98e-5b92-8fbb-9132eede6a04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102282 does not affect version 0.4.4-tuxcare.5 of adm-zip. not_affected \u2014 Version 0.4.4 predates the vulnerable feature entirely. The `keepOriginalPermission` parameter and `fileAttr` getter that enable the vulnerability were introduced in version 0.5.16+. In version 0.4.4, extraction methods (`extractAllTo`, `extractEntryTo`) never read or apply Unix permission bits from zip entries\u2014all extracted files receive default permissions (0o666). While external attributes a...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114102", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:c9685973-d432-589a-9467-588f73603262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114102 affects version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "CVE-2026-114104", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:bceac9df-8afc-5e49-882c-37d012cae49b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114104 affects version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "CVE-2026-114105", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:a11b0c06-ee0a-588c-ae14-d95147006873", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114105 does not affect version 0.4.4-tuxcare.5 of adm-zip. not_affected \u2014 adm-zip 0.4.4 is not affected by CVE-2026-114105. The vulnerability requires the keepOriginalPermission feature, which does not exist in version 0.4.4. While ZIP external file attributes containing setuid/setgid bits are read from archives, no code path applies these attributes to extracted files. All files are extracted with default permission 0666, preventing privilege escalation via setuid/s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-116137", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:882730dc-dc32-57fa-9068-f426acde998b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116137 affects version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "CVE-2026-39244", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:d0b56883-2906-53db-b1e2-dfe30e5deac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-39244 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "CVE-2026-77301", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:9fbe0bd0-5bbd-5191-b4cf-b529359ca94a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-77301 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "CVE-2026-92000", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:cb488577-2496-589c-a466-b7e1086bcdc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92000 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "GHSA-8238-w5pm-2374", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:2e6b4b86-e7c3-568b-8530-68c6c27f3e62", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8238-w5pm-2374 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "GHSA-c6fg-446q-cg94", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:db8530a0-fd02-5a25-b722-d2677118ba19", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6fg-446q-cg94 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "GHSA-p634-w6r4-rjp2", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:d2042460-156b-5ed0-baf4-56e6657fb256", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-p634-w6r4-rjp2 is fixed in version 0.4.4-tuxcare.5 of adm-zip." } }, { "id": "GHSA-rcw4-f5rp-g42v", "affects": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ], "bom-ref": "urn:uuid:05222793-932d-5bcf-acd3-d4b0399410a3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-rcw4-f5rp-g42v affects version 0.4.4-tuxcare.5 of adm-zip." } } ], "dependencies": [ { "ref": "pkg:npm/adm-zip@0.4.4-tuxcare.5" } ] }