Homepage

tar-fs@2.1.0 vulnerabilities

filesystem bindings for tar-stream

  • latest version

    3.1.1

  • latest non vulnerable version

    3.1.1

  • first published

    12 years ago

  • latest version published

    4 months ago

  • licenses detected

  • View tar-fs package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the tar-fs package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Symlink Following

    tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Symlink Following via the symlink validation process in the inCwd function. An attacker can write files outside the intended extraction directory by crafting a malicious tarball that contains symlinks starting with the name of the current working directory.

    How to fix Symlink Following?

    Upgrade tar-fs to version 1.16.6, 2.1.4, 3.1.1 or higher.

    <1.16.6>=2.0.0 <2.1.4>=3.0.0 <3.1.1
    • H
    Improper Link Resolution Before File Access ('Link Following')

    tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Improper Link Resolution Before File Access ('Link Following') through the exports.extract function. An attacker can manipulate the path of extracted files to write outside the intended directory by crafting a malicious tarball.

    How to fix Improper Link Resolution Before File Access ('Link Following')?

    Upgrade tar-fs to version 1.16.5, 2.1.3, 3.0.9 or higher.

    <1.16.5>=2.0.0 <2.1.3>=3.0.0 <3.0.9
    • H
    Symlink Attack

    tar-fs is a filesystem bindings for tar-stream.

    Affected versions of this package are vulnerable to Symlink Attack via the extraction process of a maliciously crafted tar file. An attacker can overwrite or write unauthorized files outside the intended directory by exploiting the path traversal and link following vulnerabilities.

    How to fix Symlink Attack?

    Upgrade tar-fs to version 1.16.4, 2.1.2, 3.0.7 or higher.

    <1.16.4>=2.0.0 <2.1.2>=3.0.0 <3.0.7
    Go back to all versions of this package