Homepage

org.webjars.npm:tar-fs@1.12.0 vulnerabilities

  • latest version

    3.0.8

  • first published

    9 years ago

  • latest version published

    6 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:tar-fs package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Symlink Following

    org.webjars.npm:tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Symlink Following via the symlink validation process in the inCwd function. An attacker can write files outside the intended extraction directory by crafting a malicious tarball that contains symlinks starting with the name of the current working directory.

    How to fix Symlink Following?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Improper Link Resolution Before File Access ('Link Following')

    org.webjars.npm:tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Improper Link Resolution Before File Access ('Link Following') through the exports.extract function. An attacker can manipulate the path of extracted files to write outside the intended directory by crafting a malicious tarball.

    How to fix Improper Link Resolution Before File Access ('Link Following')?

    There is no fixed version for org.webjars.npm:tar-fs.

    [0,)
    • H
    Symlink Attack

    org.webjars.npm:tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Symlink Attack via the extraction process of a maliciously crafted tar file. An attacker can overwrite or write unauthorized files outside the intended directory by exploiting the path traversal and link following vulnerabilities.

    How to fix Symlink Attack?

    Upgrade org.webjars.npm:tar-fs to version 3.0.8 or higher.

    [,3.0.8)
    • M
    Arbitrary File Overwrite

    org.webjars.npm:tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Arbitrary File Overwrite. An attacker can overwrite files on the system when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

    How to fix Arbitrary File Overwrite?

    Upgrade org.webjars.npm:tar-fs to version 1.16.2 or higher.

    [,1.16.2)
    Go back to all versions of this package