tar (npm)
Advisories
34
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.5.21 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install tar@7.5.21yarn
yarn add tar@7.5.21pnpm
pnpm add tar@7.5.21Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r292-9mhp-454m node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection |
High EPSS 0.53% |
< 7.5.21 | 7.5.21 |
| GHSA-gvwx-54wh-qm9j node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records |
Medium EPSS 0.35% |
< 7.5.17 | 7.5.17 |
| GHSA-8x88-c5mf-7j5w node-tar: Negative tar entry size causes infinite loop in archive replace |
High EPSS 0.43% |
< 7.5.18 | 7.5.18 |
| GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input |
High EPSS 0.58% |
< 7.5.19 | 7.5.19 |
| GHSA-w8wr-v893-vjvp node-tar: Process crash via PAX numeric path type confusion |
High EPSS 0.64% |
< 7.5.18 | 7.5.18 |
| GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) |
Medium EPSS 0.16% |
< 7.5.16 | 7.5.16 |
| GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath |
Medium EPSS 0.27% |
< 7.5.11 | 7.5.11 |
| GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath |
Medium EPSS 0.47% |
< 7.5.10 | 7.5.10 |
| GHSA-83g3-92jg-28cx Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction |
High EPSS 0.33% |
< 7.5.8 | 7.5.8 |
| GHSA-34x7-hfp2-rc4v node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal |
High EPSS 0.61% |
< 7.5.7 | 7.5.7 |
| GHSA-r6q2-hw4h-h46w Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS |
Medium EPSS 0.26% |
< 7.5.4 | 7.5.4 |
| GHSA-8qq5-rm4j-mr97 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization |
Medium EPSS 0.38% |
< 7.5.3 | 7.5.3 |
| GHSA-29xp-372q-xqph node-tar has a race condition leading to uninitialized memory exposure |
Medium EPSS 0.13% |
>= 7.5.1, < 7.5.2 | 7.5.2 |
| GHSA-f5x3-32g6-xq36 Denial of service while parsing a tar file due to lack of folders count validation |
Medium EPSS 0.93% |
< 6.2.1 | 6.2.1 |
| GHSA-9r2w-394v-53qc Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links |
High EPSS 3.29% |
>= 5.0.0, < 5.0.8 | 5.0.8 |
| GHSA-9r2w-394v-53qc Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links |
High EPSS 3.29% |
>= 3.0.0, < 4.4.16 | 4.4.16 |
| GHSA-9r2w-394v-53qc Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links |
High EPSS 3.29% |
>= 6.0.0, < 6.1.7 | 6.1.7 |
| GHSA-qq89-hq3f-393p Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links |
High EPSS 1.86% |
>= 5.0.0, < 5.0.10 | 5.0.10 |
| GHSA-qq89-hq3f-393p Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links |
High EPSS 1.86% |
>= 3.0.0, < 4.4.18 | 4.4.18 |
| GHSA-qq89-hq3f-393p Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links |
High EPSS 1.86% |
>= 6.0.0, < 6.1.9 | 6.1.9 |
| GHSA-5955-9wpr-37jh Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization |
High EPSS 1.27% |
< 4.4.18 | 4.4.18 |
| GHSA-5955-9wpr-37jh Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization |
High EPSS 1.27% |
>= 6.0.0, < 6.1.9 | 6.1.9 |
| GHSA-5955-9wpr-37jh Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization |
High EPSS 1.27% |
>= 5.0.0, < 5.0.10 | 5.0.10 |
| GHSA-3jfq-g458-7qm9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization |
High EPSS 15.07% |
< 3.2.2 | 3.2.2 |
| GHSA-3jfq-g458-7qm9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization |
High EPSS 15.07% |
>= 5.0.0, < 5.0.6 | 5.0.6 |
| GHSA-3jfq-g458-7qm9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization |
High EPSS 15.07% |
>= 6.0.0, < 6.1.1 | 6.1.1 |
| GHSA-3jfq-g458-7qm9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization |
High EPSS 15.07% |
>= 4.0.0, < 4.4.14 | 4.4.14 |
| GHSA-r628-mhmh-qjhw Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning |
High EPSS 7.80% |
>= 4.0.0, < 4.4.15 | 4.4.15 |
| GHSA-r628-mhmh-qjhw Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning |
High EPSS 7.80% |
>= 5.0.0, < 5.0.7 | 5.0.7 |
| GHSA-r628-mhmh-qjhw Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning |
High EPSS 7.80% |
>= 3.0.0, < 3.2.3 | 3.2.3 |
| GHSA-r628-mhmh-qjhw Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning |
High EPSS 7.80% |
>= 6.0.0, < 6.1.2 | 6.1.2 |
| GHSA-j44m-qm6p-hp7m Arbitrary File Overwrite in tar |
High EPSS 3.15% |
< 2.2.2 | 2.2.2 |
| GHSA-j44m-qm6p-hp7m Arbitrary File Overwrite in tar |
High EPSS 3.15% |
>= 3.0.0, < 4.4.2 | 4.4.2 |
| GHSA-gfjr-3jmm-4g9v Symlink Arbitrary File Overwrite in tar |
High EPSS 4.00% |
< 2.0.0 | 2.0.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor