diff --git a/changelog.d/fixes/sec-adm-zip-0.6.1-symlink-follow.md b/changelog.d/fixes/sec-adm-zip-0.6.1-symlink-follow.md
new file mode 100644
index 0000000000..00ae8cde35
--- /dev/null
+++ b/changelog.d/fixes/sec-adm-zip-0.6.1-symlink-follow.md
@@ -0,0 +1 @@
+- **fix(security):** bump the `adm-zip` override to `^0.6.1` — 0.6.0 followed a symlink already present inside the extraction root and could write outside it (GHSA-vwc7-r8mq-g2x9 / CVE-2026-76845); 0.6.1 walks every path component with `lstat` and refuses symlinks. Reached only through `onnxruntime-node`'s install script, which unpacks the vendor's own binary — no request-path exposure.
diff --git a/package-lock.json b/package-lock.json
index 280d229a98..b5d62cb4e9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15484,9 +15484,9 @@
       }
     },
     "node_modules/adm-zip": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
-      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.1.tgz",
+      "integrity": "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
diff --git a/package.json b/package.json
index a91eaade9e..5230e1710e 100644
--- a/package.json
+++ b/package.json
@@ -503,7 +503,7 @@
     "concurrently": {
       "shell-quote": "^1.9.0"
     },
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "promptfoo": {
       "js-yaml": "^5.2.2",
       "undici": "^7.29.0"