adm-zip: extracted zip entries keep setuid/setgid bits, planting root setuid binaries in builds run as root

Impact

With keepOriginalPermission=true, adm-zip before 0.6.1 applies a zip entry's stored Unix mode straight through fs.chmodSync() without masking setuid, setgid or sticky bits. A crafted archive therefore extracts a file with mode 04755, and when extraction runs as root - the default in container image builds, CI runners and privileged install steps, which is exactly where that flag gets used - the result is a root-owned setuid binary left inside the image or on the runner. Any lower-privileged user who later executes it gets root. For a GPU fleet the consequence is a baked-in root backdoor in an image shipped to every node, or root on a shared CI runner that holds registry and cluster credentials. Version 0.6.1 masks the bits.

Who can reach it

Someone who can supply the zip archive a root-run build or install step extracts with keepOriginalPermission=true - a dependency artifact, a downloaded release bundle, an uploaded file. No access to the builder itself is needed; the payload rides in the archive. Code paths that do not pass keepOriginalPermission are unaffected.

What to do

Upgrade adm-zip to 0.6.1 or later and rebuild any image or artifact produced by an affected build; a dependency bump alone does not remove a setuid binary already baked into a published image. Audit existing images and CI runner filesystems for unexpected setuid files. Where the upgrade cannot land immediately, stop passing keepOriginalPermission or stop extracting untrusted archives as root. No node or host maintenance window is involved - this is a rebuild-and-republish cost.

References

Related entries

• Flyte: FILE-mounted secrets land in pod spec env vars, readable by anyone with pod readCVE-2026-108728 · Flyte secrets webhook (FILE-mounted secrets written to the SECRETS env var)High
• Grafana: Auth Proxy cache key collision authenticates a low-privileged user as an administratorCVE-2026-14199 · Grafana Auth Proxy authentication (identity cache key built by concatenation)High
• GitLab EE: missing authorization lets a low-privileged member change restricted project settingsCVE-2026-16494 · GitLab EE (project update endpoint authorization)High
• Grafana: alert rule marked as a server-side expression bypasses datasource query authorizationCVE-2026-17183 · Grafana (alert rule server-side expression datasource authorization)High
• GitLab: unauthenticated GraphQL mutations executed via GET through multiplex query handlingCVE-2026-19650 · GitLab CE/EE (GraphQL multiplex query handling)High
• External Secrets Operator: webhook generator skips the required type label checkCVE-2026-26287 · External Secrets Operator (webhook generator EnforceLabels)High