Lack of data validation - Path Traversal In tar-fs
Description
tar-fs can extract outside the specified dir with a specific tarball
Impact
v3.0.8, v2.1.2, v1.16.4 and below
Patches
Has been patched in 3.0.9, 2.1.3, and 1.16.5
Workarounds
You can use the ignore option to ignore non files/directories.
ignore (_, header) { // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory' }
Credit
Thank you Caleb Brown from Google Open Source Security Team for reporting this in detail.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 3.0.9+~cs2.0.4-1 | ||
debian 14 | 3.0.9+~cs2.0.4-1 | ||
debian 11 | 2.1.3-0+deb11u1 | ||
debian 12 | 2.1.3-0+deb12u1 | ||
 npm | 1.16.5, 2.1.3, 3.0.9 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9.
References
1. 2. 3.