https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T06:14:09.718142+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2016-02539 cnvd-2016-02539 2026-10-15T06:14:09.722848+00:00 cnvd-2016-02539 https://cve.radiocsirt.org/vuln/euvd-2026-96011 EUVD-2026-96011 2026-10-15T06:14:09.722885+00:00 EUVD-2026-96011 https://cve.radiocsirt.org/vuln/fkie_cve-2015-8860 fkie_cve-2015-8860 2026-10-15T06:14:09.722900+00:00

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

 https://cve.radiocsirt.org/vuln/ghsa-gfjr-3jmm-4g9v GHSA-gfjr-3jmm-4g9v — Symlink Arbitrary File Overwrite in tar 2026-10-15T06:14:09.722930+00:00

Affected: npm: tar

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.

## Recommendation

Update to version 2.0.0 or later

 https://cve.radiocsirt.org/vuln/gsd-2015-8860 gsd-2015-8860 2026-10-15T06:14:09.722955+00:00 gsd-2015-8860 https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-8860 UBUNTU-CVE-2015-8860 2026-10-15T06:14:09.722967+00:00

Affected: Ubuntu:Pro:14.04:LTS: node-tar, Ubuntu:Pro:16.04:LTS: node-tar

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.