Skip to content
OpenAdvisories
High USN-4777-1 1 CVE

node-tar vulnerability

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that node-tar mishandled certain tar archives. An
attacker could use this vulnerability to write arbitrary files to the
filesystem.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS node-tar 0.1.18-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS node-tar 1.0.3-2ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2015-8860

    Symlink Arbitrary File Overwrite in tar

    The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

    tar node-tar node-tar Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2015-8860