PT-2026-67425

Name of the Vulnerable Software and Affected Versions GNU tar affected versions not specified Description A flaw exists when extracting an archive using the --one-top-level option. Hardlink targets are not restricted to the designated top-level directory and may resolve relative to the extraction...

GHSA-9XQ3-3FQG-4VG7 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Repository: termux/proot-distro Component: prootdistro/commands/install.py → extractplaintar; also helpers/docker.py → applylayer --- Affected Versions | Component | Version | |---------------|------------------------------| | proot-distro | 5.0.2 confirmed vulnerable | | Termux app |...

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Repository: termux/proot-distro Component: prootdistro/commands/install.py → extractplaintar; also helpers/docker.py → applylayer --- Affected Versions | Component | Version | |---------------|------------------------------| | proot-distro | 5.0.2 confirmed vulnerable | | Termux app |...

UNIX Symbolic Link (Symlink) Following

Overview proot-distro is a PRoot-Distro is a lightweight rootless Linux container management utility built around proot. Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the prootdistro/commands/install.py function and the equivalent process in...

CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...

CVE-2026-50558

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

GHSA-F42X-P2MX-HM8R Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

EUVD-2026-50395

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

CVE-2026-50558

Penelope Shell Handler vulnerability CVE-2026-50558 affects the Unix download() implementation in penelope.py. Prior to version 0.20.0, tar.extractall(local_download_folder) on tar archives from remote sessions did not validate member paths, allowing a malicious or compromised session to write fi...

CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

Summary Req's default response pipeline auto-decodes archive and compressed bodies based on the server-supplied content-type or URL extension and materialises the full decompressed contents in memory with no size cap. An attacker who controls or can redirect a victim into an HTTP endpoint reached...

PT-2026-65830

Name of the Vulnerable Software and Affected Versions Penelope versions prior to 0.20.0 Description The Unix download implementation in penelope.py fails to validate member paths when extracting tar archives received from remote sessions. A malicious or compromised session can return a crafted ta...

MAL-2026-11150 Malicious code in streak-daily-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...

GO-2026-5880 Hardlink path traversal during tar extraction in oras.land/oras-go

Hardlink path traversal during tar extraction in oras.land/oras-go...

Uncontrolled Recursion

Overview tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname call per recursion and no segment cap. An attacker can...

GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion

Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...

GHSA-GVWX-54WH-QM9J node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Summary node-tar strips trailing NUL bytes from long-name L and long-linkpath K GNU extended headers but does not apply the same sanitization to equivalent fields delivered via PAX x typeflag extended headers. A PAX record of the form path=visible.txt\x00hidden.txt is parsed verbatim into...