logo

Database

Lack of data validation - Path Traversal In @vltpkg/tar

Description

vlt Mishandles Path Sanitization for tar vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2026-249092. NVD-2026-249093. OSV-2026-249094. GCVE-2026-24909

References

1. https://github.com/vltpkg/vltpkg/pull/13342. https://github.com/vltpkg/vltpkg/commit/ff8d4099a1929772cea2adf131285e90ede6b0dd3. https://github.com/vltpkg/vltpkg/releases/tag/v1.0.0-rc.104. https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act5. https://www.scworld.com/news/six-javascript-zero-day-bugs-lead-to-fears-of-supply-chain-attack

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.