GHSA-p634-w6r4-rjp2
MediumAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 62
- of 17,957 indexed, latest versions
- Container images
- 52
- deployed by those charts
- Fix available
- 1 of 1
- affected package
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Carried by container images the latest versions of 62 of 17,957 indexed charts deploy, on 52 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| adm-zipnpm | 0.4.11, 0.4.13, 0.4.16, 0.5.3+9 more | 0.6.1 | 52 |
- OSV records
- GHSA-p634-w6r4-rjp2
Charts affected
62 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| joplin-serverschoenwald | 1.0.3 | 1 of 1See more | 2,858 |
| infisicalsinextraVerified publisher | 0.6.0 | 1 of 1See more | 3,603 |
| trudesktechpreta | 1.0.0 | 1 of 3See more | 4,267 |
| chatqnatest-opea | 1.0.0 | 1 of 11See more | 41,947 |
| redis-vector-dbtest-opea | 1.0.0 | 1 of 1See more | 6,111 |
| vehicle-dashboardtest-vehi-dash | 0.1.0 | 1 of 7See more | 21,257 |
| thanhvt27-lab-k8sthanh-vtVerified publisher | 0.1.4 | 1 of 5See more | 4,907 |
| joplintobiassackmann | 0.1.7 | 1 of 2See more | 6,149 |
| homarrvhdirkVerified publisher | 0.1.5 | 1 of 1See more | 2,919 |
| tdarrvhdirkVerified publisher | 5.0.5 | 1 of 2See more | 166,746 |
| colanodevictorlane | 0.3.3 | 1 of 3See more | 2,529 |
| n8nvictorlane | 1.0.18 | 1 of 1See more | 7,015 |
Container images carrying it
52 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| registry.gitlab.com/ | c7afac3446d6 | adm-zip | 0.6.1 | 1 |
| registry.gitlab.com/ | 0e3cd8c7776d | adm-zip | 0.6.1 | 1 |