GHSA-8cj5-5rvv-wf4vHigh

tar-fs can extract outside the specified dir with a specific tarball

Published
June 3, 2025
Last Modified
November 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-48387 →

📋 Description

Impact

v3.0.8, v2.1.2, v1.16.4 and below

Patches

Has been patched in 3.0.9, 2.1.3, and 1.16.5

Workarounds

You can use the ignore option to ignore non files/directories.

  ignore (_, header) {
    // pass files & directories, ignore e.g. symlinks
    return header.type !== 'file' && header.type !== 'directory'
  }

Credit

Thank you Caleb Brown from Google Open Source Security Team for reporting this in detail.

🎯 Affected products3

  • npm/tar-fs:< 1.16.5
  • npm/tar-fs:>= 2.0.0, < 2.1.3
  • npm/tar-fs:>= 3.0.0, < 3.0.9

🔗 References (6)