Most recent entries from all

cnvd-2016-02539

EUVD-2026-96011

fkie_cve-2015-8860

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

GHSA-gfjr-3jmm-4g9v — Symlink Arbitrary File Overwrite in tar

Affected: npm: tar

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.

## Recommendation

Update to version 2.0.0 or later

gsd-2015-8860

UBUNTU-CVE-2015-8860

Affected: Ubuntu:Pro:14.04:LTS: node-tar, Ubuntu:Pro:16.04:LTS: node-tar

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.