Skip to content
OpenAdvisories
High USN-5283-1 1 CVE

node-tar vulnerability

Published Feb 11, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tar for Node.js did not properly sanitize path inputs.
An attacker could possibly use this issue to read arbitrary files, resulting
in a directory traversal attack.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS node-tar 4.4.10+ds1-2ubuntu1+esm1

Vulnerabilities 1

  • High 8.2
    CVE-2021-32803

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…

    npm node-tar tar node-tar Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2021-32803