Skip to content
OpenAdvisories
High DLA-4214-1 2 CVEs

node-tar-fs - security update

Published Jun 11, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 node-tar-fs 2.1.3-0+deb11u1

Vulnerabilities 2

  • High 8.7
    CVE-2025-48387

    tar-fs has issue where extract can write outside the specified dir with a specific tarball

    tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaro…

    Mafintosh tar-fs jitsucom-jitsu-console sqlpad Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2024-12905 Public exploit

    tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

    An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized fi…

    sqlpad code-server tileserver-gl reaper Debian Ubuntu Azure Linux Wolfi npm