GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-114105: Js Zip Unix Mode Mask Keeps Setuid Setgid Sticky Bitscve-2026-114105-js-zip-unix-mode-mask-keeps-setuid-setgid-sticky-bits

A Unix permission mode is derived from archive entry attributes with a mask ($MASK) that keeps the setuid (0o4000), setgid (0o2000) and sticky (0o1000) bits. Those bits come verbatim from attacker-controlled archive metadata; when the resulting mode is applied to extracted files (chmod/chmodSync, e.g. behind a keepOriginalPermission option), a crafted archiv

JSCVE-2026-114105CWE-732
by Provallyupdated 2026-10-27Apache-2.0
460 direct46 via packs
78
All matching rules loaded.