@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: GHSA-GF2C-JWCJ-X929...