Packages / tar / Security

HighVulnerabilityGHSA-gfjr-3jmm-4g9vCVE-2015-8860Published 24 Oct 2017

Symlink Arbitrary File Overwrite in tar

Your version

Affected releases · tar

  • 1.x and older0.0.1 – 1.0.3No fix, no longer updated

1.x has no fix yet; the newest fixed line:

npm install tar@2.0.0
Every release on a timeline
7.x

  1. Not affected

    7.0.0 – 7.5.22

    33 releases, latest

1.x

  1. Affected

    1.0.0 – 1.0.3

    4 releases

0.x

  1. Affected

    0.0.1 – 0.1.20

    21 releases

154 stable releases of tar, oldest to newest, one row per major.

What happens

Versions of tar prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because tar does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.

Recommendation

Update to version 2.0.0 or later