Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-24909 EUVD-2026-4860GHSA-gf2c-jwcj-x929

vlt Mishandles Path Sanitization for tar

Published Jan 27, 2026 · Updated Jan 28, 2026 · Assigned by mitre

Vendor: vlt Product: vlt Package: @vltpkg/tar Ecosystem: npm

Description

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

Affected products

VendorProductAffectedFixed
vlt vlt < 1.0.0-rc.10 1.0.0-rc.10

Affected packages

EcosystemPackageAffectedFixedRecord
npm @vltpkg/tar < 1.0.0-rc.10 1.0.0-rc.10 GHSA-gf2c-jwcj-x929

References