{"id":"CVE-2025-59343","aliases":["CLSA-2026-1774484497","CLSA-2026-1788560472","CLSA-2026-1790963499","DEBIAN-CVE-2025-59343","DLA-4313-1","DSA-6013-1","EUVD-2025-31022","GHSA-vj76-c3g6-qr5v","RHSA-2025:18979","RHSA-2025:19201","ROOT-APP-NPM-CVE-2025-59343","UBUNTU-CVE-2025-59343","USN-8367-1","fix-test-env-compat","openSUSE-SU-2025:15582-1","openSUSE-SU-2026:20998-1"],"status":"published","title":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0058,"percentile":0.48159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-61"],"published":"2025-09-24T17:43:34Z","modified":"2026-11-06T13:15:18Z","fixes":[{"ecosystem":"npm","package":"tar-fs","fixed_in":["3.1.1","2.1.4","1.16.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-tar-fs","fixed_in":["2.1.3-0+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tar-fs","fixed_in":["3.0.9+~cs2.0.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar-fs","fixed_in":["3.0.9+~cs2.0.4-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"node-tar-fs","fixed_in":["2.1.3-0+deb11u2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar-fs","fixed_in":["3.1.0-aikido.2","3.0.8-aikido.2","3.0.9-aikido.2","2.0.0-aikido.4","2.1.2-aikido.1","2.1.2-aikido.2","1.16.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar-fs","fixed_in":["3.1.0-root.io.1","3.0.8-root.io.1","3.0.6-root.io.1","3.0.9-root.io.1","2.0.0-root.io.3","3.1.0-root.io.2","3.0.8-root.io.2","3.0.9-root.io.2","2.0.0-root.io.4","2.1.2-root.io.1","2.1.2-root.io.2","1.16.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","fixed_in":["2.1.1-6ubuntu0.22.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","fixed_in":["2.1.1-6ubuntu0.24.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"node-tar-fs","fixed_in":["3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.1"}]}],"versions":["3.0.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.1"}]}],"versions":["2.1.1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb12u2"}]}],"versions":["2.1.1-6","2.1.3-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1+deb13u1"}]}],"versions":["3.0.9+~cs2.0.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-2"}]}],"versions":["3.0.9+~cs2.0.4-1"]},{"source":"osv","ecosystem":"Debian:11","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb11u2"}]}],"versions":["2.1.1-2","2.1.1-3","2.1.1-4","2.1.1-6","2.1.3-0+deb11u1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb12u2"}]}],"versions":["2.1.1-6","2.1.3-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1+deb13u1"}]}],"versions":["3.0.9+~cs2.0.4-1"]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.6"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-aikido.2"},{"fixed":"3.0.8-aikido.2"},{"fixed":"3.0.9-aikido.2"},{"fixed":"2.0.0-aikido.4"},{"fixed":"2.1.2-aikido.1"},{"fixed":"2.1.2-aikido.2"},{"fixed":"1.16.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-root.io.1"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.6-root.io.1"},{"fixed":"3.0.9-root.io.1"},{"fixed":"2.0.0-root.io.3"},{"fixed":"3.1.0-root.io.2"},{"fixed":"3.0.8-root.io.2"},{"fixed":"3.0.9-root.io.2"},{"fixed":"2.0.0-root.io.4"},{"fixed":"2.1.2-root.io.1"},{"fixed":"2.1.2-root.io.2"},{"fixed":"1.16.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.22.04.1~esm1"}]}],"versions":["2.1.1-2","2.1.1-4","2.1.1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.24.04.1~esm1"}]}],"versions":["2.1.1-6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1"}]}],"versions":["2.1.1-6","3.0.8+~cs2.0.4-1","3.0.9+~cs2.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.22.04.1~esm1"}]}],"versions":["2.1.1-2","2.1.1-4","2.1.1-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.24.04.1~esm1"}]}],"versions":["2.1.1-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1"}]}],"versions":["2.1.1-6","3.0.8+~cs2.0.4-1","3.0.9+~cs2.0.4-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tree-sitter-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tree-sitter-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"mafintosh","product":"tar-fs"}],"references":[{"url":"https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vj76-c3g6-qr5v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59343.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-59343","tags":["advisory"]},{"url":"https://github.com/mafintosh/tar-fs","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2025:18979","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2397901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2400450","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAP-56352","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18979.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59343","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59682","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19201","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392835","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAP-49448","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19201.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9907","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9908","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-59343","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8367-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-12905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48387","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59343","tags":["web"]},{"url":"https://bugzilla.suse.com/1244345","tags":["report"]},{"url":"https://bugzilla.suse.com/1250517","tags":["report"]},{"url":"https://bugzilla.suse.com/1267461","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-59343","title":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","status":"published","published":"2025-09-24T17:43:34.728Z","modified":"2025-11-03T18:13:55.412Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-61"],"updated_at":"2026-11-02T14:32:47.447481Z"}],"euvd":[{"id":"EUVD-2025-31022","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","status":"published","published":"2025-09-24T17:43:34Z","modified":"2025-11-03T18:13:55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:34.635725Z"}],"ghsa":[{"id":"GHSA-vj76-c3g6-qr5v","title":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","description":"### Impact\n v3.1.0, v2.1.3, v1.16.5 and below\n\n### Patches\nHas been patched in 3.1.1, 2.1.4, and 1.16.6\n\n### Workarounds\nYou can use the ignore option to ignore non files/directories.\n\n```js\n  ignore (_, header) {\n    // pass files \u0026 directories, ignore e.g. symlinks\n    return header.type !== 'file' \u0026\u0026 header.type !== 'directory'\n  }\n```\n\n### Credit\nReported by: Mapta / BugBunny_ai","status":"published","published":"2025-09-24T18:57:04Z","modified":"2025-11-03T21:34:36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22","CWE-61"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-59343","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","status":"published","published":"2025-09-24T18:15:42.297Z","modified":"2026-06-17T09:45:56.623Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-61"],"updated_at":"2026-11-02T14:11:32.559087Z"}],"osv":[{"id":"CVE-2025-59343","title":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","status":"published","published":"2025-09-24T17:43:34.728Z","modified":"2026-10-28T02:30:36.073848715Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22","CWE-61"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"DEBIAN-CVE-2025-59343","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","status":"published","published":"2025-09-24T18:15:42.297Z","modified":"2026-09-01T20:05:54.686185038Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-vj76-c3g6-qr5v","title":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","description":"### Impact\n v3.1.0, v2.1.3, v1.16.5 and below\n\n### Patches\nHas been patched in 3.1.1, 2.1.4, and 1.16.6\n\n### Workarounds\nYou can use the ignore option to ignore non files/directories.\n\n```js\n  ignore (_, header) {\n    // pass files \u0026 directories, ignore e.g. symlinks\n    return header.type !== 'file' \u0026\u0026 header.type !== 'directory'\n  }\n```\n\n### Credit\nReported by: Mapta / BugBunny_ai","status":"published","published":"2025-09-24T18:57:04Z","modified":"2026-09-10T03:50:28.767326235Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22","CWE-61"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"RHSA-2025:18979","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-10-23T10:05:35Z","modified":"2026-09-22T10:04:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:19201","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2025-10-29T10:04:30Z","modified":"2026-09-22T10:04:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"ROOT-APP-NPM-CVE-2025-59343","title":"CVE-2025-59343 in tar-fs - Patched by Root","description":"Root has patched CVE-2025-59343 in the tar-fs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T12:16:13Z","modified":"2026-11-06T13:15:18.648280147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"UBUNTU-CVE-2025-59343","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","status":"published","published":"2025-09-24T18:15:00Z","modified":"2026-06-02T18:15:54.307932522Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"CLSA-2026-1774484497","title":"TuxCare security update for tar-fs (5 CVEs)","description":"TuxCare rebuilt tar-fs to address 5 CVEs. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.625091925Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1788560472","title":"TuxCare security update for tar-fs (3 CVEs)","description":"TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 3.0.4-tuxcare.1.","status":"published","published":"2026-09-04T22:21:12Z","modified":"2026-10-15T09:48:03.105068614Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790963499","title":"TuxCare security update for tar-fs (3 CVEs)","description":"TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1.","status":"published","published":"2026-10-02T17:51:39Z","modified":"2026-10-15T09:47:58.002826907Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"DLA-4313-1","title":"node-tar-fs - security update","status":"published","published":"2025-09-27T00:00:00Z","modified":"2025-09-27T21:31:55.019173Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6013-1","title":"node-tar-fs - security update","status":"published","published":"2025-09-28T00:00:00Z","modified":"2025-09-28T14:34:13.630143Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15582-1","title":"tree-sitter-ruby-0.23.1-2.1 on GA media","description":"These are all security issues fixed in the tree-sitter-ruby-0.23.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-26T00:00:00Z","modified":"2026-03-23T04:53:58.247448Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20998-1","title":"Security update for tree-sitter-ruby","description":"This update for tree-sitter-ruby fixes the following issues\n\n- CVE-2025-5889: brace-expansion: inefficient regular expression complexity in function expand of file index.js\n  (bsc#1244345).\n- CVE-2025-59343: tar-fs: tar-fs symlink validation bypass (bsc#1250517).\n\nChanges for tree-sitter-ruby:\n\n- Use correct tree-sitter dirname instead of tree_sitter\n (bsc#1267461).\n\n- update to 0.23.1:\n\n * ci(publish): add attestations and generate parser\n * build: update bindings\n * fix: remove unnecessary empty string usage\n * chore: regenerate\n * ci: update workflows\n * fix(swift): include scanner.c\n\n- update to 0.23.0:\n\n * fix(go): correct test\n * fix: handle != operator definition\n * feat: support element references with blocks\n * fix: do not require newline after block comment =end\n * fix: parsing of multiple unicode escapes\n * fix: correct repo url\n\n- update to 0.21.0:\n\n * feat: rewrite scanner with array header and regenerate\n * build: update bindings and manifests\n * fix: reverse precedence queries\n * fix: escape braces in regex\n * docs: update badges\n\n- switch to download_files service\n- add neovim links\n- add license file to package\n","status":"published","published":"2026-06-22T07:40:16Z","modified":"2026-06-30T18:24:28.059145871Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"USN-8367-1","title":"node-tar-fs vulnerabilities","description":"It was discovered that tar-fs did not properly limit paths when\nextracting crafted tar files. An attacker could possibly use this\nissue to write or overwrite files outside the intended extraction\ndirectory. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2024-12905)\n\nIt was discovered that tar-fs did not properly validate extraction\npaths for certain crafted tar archives. An attacker could possibly\nuse this issue to write files outside the intended extraction\ndirectory. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2025-48387)\n\nIt was discovered that tar-fs had a symlink validation bypass when\nextracting crafted tar files. An attacker could possibly use this\nissue to write files outside the intended extraction directory.\n(CVE-2025-59343)","status":"published","published":"2026-06-02T13:00:16Z","modified":"2026-06-02T18:33:02.168695126Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}