CVE-2026-76845: Cline arbitrary file overwrite

Q: Is CVE-2026-76845 actively exploited?

No confirmed active exploitation of CVE-2026-76845 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-76845?

Track the adm-zip GitHub repository and VulnCheck advisory for a patched release beyond 0.6.0 and upgrade as soon as one ships. Until then, disable the overwrite option when extracting any archive whose contents or destination directory cannot be fully trusted, and avoid extracting into shared or reused temporary directories — use a freshly created, uniquely named directory per extraction job (common in ephemeral CI runners and containerized agent sandboxes) and destroy it afterward. As a compensating control, scan extraction destinations for pre-existing symlinks before invoking extraction (lstat check) and reject extraction if any are found. For detection, monitor for files outside expected build/extraction roots being modified by processes that invoke adm-zip, and audit CI workspace reuse patterns for AI pipeline jobs.

Q: What systems are affected by CVE-2026-76845?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, training pipelines, model serving.

Q: What is the CVSS score for CVE-2026-76845?

CVE-2026-76845 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.17%.

CISO Take

adm-zip versions 0.5.9 through 0.6.0 follow symbolic links during ZIP extraction, letting a pre-planted symlink at the destination redirect a written entry to any file the extracting process can write, without any path traversal sequence appearing in the archive. This matters wherever AI pipelines or agent tooling unpack downloaded models, datasets, or plugin bundles into shared or reused directories, such as CI/CD workspaces or agent sandboxes, since the flaw requires only local low-privilege access to plant a symlink beforehand. There is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template for this CVE, and downstream dependent counts are unknown, so current real-world exploitation pressure appears low despite the low attack complexity. Because exploitation depends on the extracting process running with overwrite enabled, the most effective mitigation today is to disable overwrite on untrusted archives and use fresh, non-reused extraction directories per job until a patched adm-zip release is confirmed. Security teams running AI agent frameworks or ML CI/CD should audit archive-extraction code paths for adm-zip usage and reused temp/workspace directories as a detection priority.

Sources:NVDVulnCheckATLAS

What is the risk?

CVSS 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) reflects a high-integrity-impact but local-only vulnerability: an attacker must already have low-privileged write access to the extraction destination to plant the symlink, which meaningfully limits remote exploitability. The technique itself (CWE-59, link following) is well understood and trivial to weaponize once local access exists, and the lack of any O_NOFOLLOW or pre-write lstat check means the fix is purely in the library's control-flow, not a hardening measure the caller can easily bolt on except by disabling overwrite. With no EPSS data, no KEV listing, and no public PoC or scanner coverage, near-term mass exploitation is unlikely, but the vulnerability is a realistic risk in multi-tenant or shared-workspace environments common to AI/ML build and agent-execution infrastructure.

How does the attack unfold?

Preposition symlink

Attacker with local low-privilege access creates a symbolic link at a predictable path inside a shared or reused extraction directory, pointing to a sensitive file outside the extraction root.

Trigger extraction

A legitimate AI pipeline or agent process later extracts a ZIP archive with overwrite enabled into that same directory, using an entry name matching the planted symlink.

AML.T0010.001

Write through symlink

adm-zip's Utils.writeFileTo opens the resolved symlink target without O_NOFOLLOW or a pre-write lstat check, writing attacker-controlled content through it.

Impact

A file outside the intended extraction root, such as credentials, configuration, or another job's artifacts, is overwritten with attacker-controlled data.

Preposition symlink

Attacker with local low-privilege access creates a symbolic link at a predictable path inside a shared or reused extraction directory, pointing to a sensitive file outside the extraction root.

Trigger extraction

A legitimate AI pipeline or agent process later extracts a ZIP archive with overwrite enabled into that same directory, using an entry name matching the planted symlink.

AML.T0010.001

Write through symlink

adm-zip's Utils.writeFileTo opens the resolved symlink target without O_NOFOLLOW or a pre-write lstat check, writing attacker-controlled content through it.

Impact

A file outside the intended extraction root, such as credentials, configuration, or another job's artifacts, is overwritten with attacker-controlled data.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cline	npm	>= 0.5.9, <= 0.6.0	No patch
71.1K2 dependentsPushed today75% patched~19d to patchFull package profile →
adm-zip	—	—	No patch

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SChanged

CNone

IHigh

ANone

What should I do?

1 step

Track the adm-zip GitHub repository and VulnCheck advisory for a patched release beyond 0.6.0 and upgrade as soon as one ships. Until then, disable the overwrite option when extracting any archive whose contents or destination directory cannot be fully trusted, and avoid extracting into shared or reused temporary directories — use a freshly created, uniquely named directory per extraction job (common in ephemeral CI runners and containerized agent sandboxes) and destroy it afterward. As a compensating control, scan extraction destinations for pre-existing symlinks before invoking extraction (lstat check) and reject extraction if any are found. For detection, monitor for files outside expected build/extraction roots being modified by processes that invoke adm-zip, and audit CI workspace reuse patterns for AI pipeline jobs.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentAML.T0010.001- AI Software

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.2-Third-party and supplier relationships

NIST AI RMF

GOVERN-6.1-Third-party risks and responsibilities

Frequently Asked Questions

What is CVE-2026-76845?

adm-zip versions 0.5.9 through 0.6.0 follow symbolic links during ZIP extraction, letting a pre-planted symlink at the destination redirect a written entry to any file the extracting process can write, without any path traversal sequence appearing in the archive. This matters wherever AI pipelines or agent tooling unpack downloaded models, datasets, or plugin bundles into shared or reused directories, such as CI/CD workspaces or agent sandboxes, since the flaw requires only local low-privilege access to plant a symlink beforehand. There is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template for this CVE, and downstream dependent counts are unknown, so current real-world exploitation pressure appears low despite the low attack complexity. Because exploitation depends on the extracting process running with overwrite enabled, the most effective mitigation today is to disable overwrite on untrusted archives and use fresh, non-reused extraction directories per job until a patched adm-zip release is confirmed. Security teams running AI agent frameworks or ML CI/CD should audit archive-extraction code paths for adm-zip usage and reused temp/workspace directories as a detection priority.

Is CVE-2026-76845 actively exploited?

No confirmed active exploitation of CVE-2026-76845 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-76845?

Track the adm-zip GitHub repository and VulnCheck advisory for a patched release beyond 0.6.0 and upgrade as soon as one ships. Until then, disable the overwrite option when extracting any archive whose contents or destination directory cannot be fully trusted, and avoid extracting into shared or reused temporary directories — use a freshly created, uniquely named directory per extraction job (common in ephemeral CI runners and containerized agent sandboxes) and destroy it afterward. As a compensating control, scan extraction destinations for pre-existing symlinks before invoking extraction (lstat check) and reject extraction if any are found. For detection, monitor for files outside expected build/extraction roots being modified by processes that invoke adm-zip, and audit CI workspace reuse patterns for AI pipeline jobs.

What systems are affected by CVE-2026-76845?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, training pipelines, model serving.

What is the CVSS score for CVE-2026-76845?

CVE-2026-76845 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstraining pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0010.001AI Software

Compliance Controls Affected

ISO 42001: A.6.2.2

NIST AI RMF: GOVERN-6.1

What are the technical details?

Original Advisory

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.

Exploitation Scenario

An attacker with low-privileged access to a shared CI runner or AI agent execution sandbox plants a symbolic link named, for example, 'config.json' inside a temp directory that will later be reused as an extraction destination, pointing that link at a sensitive file outside the sandbox such as a credentials file or another tenant's model checkpoint. A subsequent automated job — for instance, an ML pipeline step that downloads and unpacks a model or dataset bundle with overwrite enabled — extracts an archive containing an entry also named 'config.json'. adm-zip resolves the existing symlink rather than detecting the conflict, and Utils.writeFileTo writes the attacker-supplied archive content through the link, overwriting the sensitive target file with no traversal sequence ever appearing in the archive to trip signature-based defenses.

Weaknesses (CWE)

CWE-59Improper Link Resolution Before File Access ('Link Following')Primary CWE-59Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.