Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 6.3 | CVE-2026-116137 |
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like...
cthackers, adm-zipcthackers adm-zip, adm-zip
|
NVD | |||
|
CVE-2026-116137adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like...
Executive summaryThe advisory says adm-zip through version 0.6.1, a JavaScript library for handling zip files in Node.js, contains a flaw that lets attackers get past its duplicate-entry check. The advisory text provided is cut off and does not state a severity rating or a fix for this issue. The vendor's recommended action is not stated in the text provided. Technical summaryThe flaw is a validation bypass: attackers can evade the duplicate-entry check in readEntries() by using canonically equivalent entry names. The advisory excerpt is truncated and does not give the attack vector details, required preconditions, or the full example. Affected versions are stated as through 0.6.1. A fixed version is not stated. A workaround is not stated. Detection guidance is not stated. A CVSS score is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cthackers/adm-zip Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||