{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.5.9","last_affected":"0.6.0"}],"component":"adm-zip","cve_ids":["CVE-2026-76845"],"ecosystem":"npm","epss":0.00171,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vwc7-r8mq-g2x9","id":"tcs_01M5KGD4ABS594DF6MGACN32CK","modified_at":"2026-09-08T21:40:56.957653Z","published_at":"2026-08-24T15:31:51Z","references":["https://osv.dev/vulnerability/GHSA-vwc7-r8mq-g2x9","https://nvd.nist.gov/vuln/detail/CVE-2026-76845","https://github.com/cthackers/adm-zip/issues/574","https://github.com/cthackers/adm-zip/pull/575","https://github.com/cthackers/adm-zip","https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js","https://www.vulncheck.com/advisories/adm-zip-through-arbitrary-file-overwrite-via-symlink-following-on-extraction"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-vwc7-r8mq-g2x9","url":"https://osv.dev/vulnerability/GHSA-vwc7-r8mq-g2x9"}],"summary":"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite"}