Description (CNA)
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| isaacs / node-tar | affected < 7.5.10 |
CWE
CWE-22, CWE-59
References
- https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96
- https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in node-tar. A hardlink that points outside the extraction directory can be created by using a drive-relative link target such as C:../target.txt, allowing a file overwrite outside the current working directory during normal tar.x() extraction.