node-tar Symlink Path Traversal via Drive-Relative Linkpath
Résumé
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Description d'origine
La description telle que publiée par la source (souvent en anglais).
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-31802 node-tar Corrigé dans: 6.0.5+ds1+~cs11.3.9-1+deb11u3
- Ubuntu UBUNTU-CVE-2026-31802 node-tar
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com