Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
adm-zip could let attackers execute code
published 23 days ago
Summary
The JavaScript library called adm-zip, used in several projects, had a flaw that could let a malicious actor run unwanted code on a system that processes zip files. The issue has been corrected in newer versions of the library, so updating to the latest release will protect your applications.
What to do
- Update cthackers adm-zip to version 0.6.0-aikido.3.
- Update rootio @rootio/adm-zip to version 0.6.0-root.io.3.
- Update adm-zip to version 0.5.10-aikido.5.
- Update rootio @rootio/adm-zip to version 0.5.10-root.io.5.
- Update adm-zip to version 0.5.9-aikido.2.
- Update rootio @rootio/adm-zip to version 0.5.9-root.io.2.
- Update adm-zip to version 0.5.18-aikido.3.
- Update rootio @rootio/adm-zip to version 0.5.18-root.io.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Root:npm | cthackers | adm-zip |
< 0.6.0-aikido.3 Fix: upgrade to 0.6.0-aikido.3
|
| Root:npm | rootio | @rootio/adm-zip |
< 0.6.0-root.io.3 < 0.5.10-root.io.5 < 0.5.9-root.io.2 < 0.5.18-root.io.3 Fix: upgrade to 0.6.0-root.io.3
|
| Root:npm | – | adm-zip |
< 0.5.10-aikido.5 < 0.5.9-aikido.2 < 0.5.18-aikido.3 Fix: upgrade to 0.5.10-aikido.5
|
Original advisory text
GHSA-rcw4-f5rp-g42v in adm-zip - Patched by Root
Root has patched GHSA-rcw4-f5rp-g42v in the adm-zip package for Root:npm. Multiple fixed versions available.
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen5 Oct 2026
Sources
Track software like this
Free during beta