adm-zip@0.1.9

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the fileAttr getter in headers/entryHeader.js, which preserves attacker-controlled Unix special permission bits (setuid 0o4000, setgid 0o2000, and sticky 0o1000) from ZIP archive metadata during extraction. When the keepOriginalPermission option is used and extraction is performed as root, an attacker who controls the ZIP archive can plant a setuid-root binary, achieving local privilege escalation.

Note: This is only exploitable when extraction is performed as a privileged user (e.g., root) with the keepOriginalPermission option enabled.

Upgrade adm-zip to version 0.6.1 or higher.

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Uncaught Exception via inflateAsync in methods/inflater.js when processing a ZIP entry containing malformed DEFLATE data. The zlib.createInflateRaw stream emits an error event (e.g. Z_DATA_ERROR) that has no registered listener, causing Node.js to re-throw it as an uncaught exception on a later tick and crash the host process.

Upgrade adm-zip to version 0.6.1 or higher.

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Incorrect Behavior Order via duplicate entry names in a ZIP archive processed by zipFile.js. Because adm-zip stores all entries in entryList (used by extractAllTo()) but only the last occurrence of a name in entryTable (used by getEntry()), an attacker can supply an archive containing two entries with the same name. An application that validates entry content by calling getEntry() before extracting will inspect one file, while extractAllTo() writes a different file to disk, allowing the attacker to bypass content validation and land arbitrary content on the filesystem.

Upgrade adm-zip to version 0.6.1 or higher.

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's maxOutputLength option is not applied to the streaming API. An attacker can supply a zip archive whose entries declare a small or zero uncompressed size but contain a large compressed payload (a decompression bomb), causing unbounded memory growth and a crash of the host process. Additionally, a declared size of 0 previously disabled the cap entirely on the synchronous path, allowing the same class of attack through entries that lie about their size.

Upgrade adm-zip to version 0.6.1 or higher.

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the inflater process. An attacker can exhaust system memory and disrupt service availability by submitting specially crafted ZIP archives with highly compressible entries that declare a zero uncompressed size.

Upgrade adm-zip to version 0.6.1 or higher.

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in zipEntry.js and entryHeader.js, which size a Buffer.alloc() call directly from the uncompressed-size field of a ZIP central directory header without validating it. An attacker can crash the process with an out-of-memory condition by supplying a small ZIP file, around 120 bytes, whose header declares a roughly 4 GB uncompressed size, triggering the oversized allocation before any CRC check.

Upgrade adm-zip to version 0.5.18 or higher.

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Directory Traversal. It could extract files outside the target folder.

Upgrade adm-zip to version 0.5.2 or higher.