node-tar has a race condition leading to uninitialized memory exposure

Summary Using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. Details See: https://github.com/isaacs/node-tar/issues/445 https://github.com/isaacs/node-tar/pull/446 Regression happene...

GHSA-29XP-372Q-XQPH node-tar has a race condition leading to uninitialized memory exposure

Summary Using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. Details See: https://github.com/isaacs/node-tar/issues/445 https://github.com/isaacs/node-tar/pull/446 Regression happene...

@adobe/helix-deploy-plugin-edge (>=1.1.10, <=1.1.16), @cyclonedx/cdxgen (>=11.9.0, <=11.11.0) +22 more potentially affected by CVE-2025-64118 via tar (7.5.1)

tar NPM version 7.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tar and may be impacted: - @adobe/helix-deploy-plugin-edge =1.1.10, =11.9.0, =2.0.27, =5.0.51, =0.45.2, =1.0.0-beta.2, =0.3.1, =4.4.2, =1.9.0, =1.6.1, =0.0.11, =1.0.1, =0.1.0, =0.2.2...

@adobe/helix-deploy-plugin-edge (>=1.1.10, <=1.1.16), @cyclonedx/cdxgen (>=11.9.0, <=11.11.0) +22 more potentially affected by CVE-2025-64118 via tar (7.5.1)

tar NPM version 7.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tar and may be impacted: - @adobe/helix-deploy-plugin-edge =1.1.10, =11.9.0, =2.0.27, =5.0.51, =0.45.2, =1.0.0-beta.2, =0.3.1, =4.4.2, =1.9.0, =1.6.1, =0.0.11, =1.0.1, =0.1.0, =0.2.2...

CVE-2025-12060

CVE-2025-12060 concerns Keras: when using keras.utils.get_file with extract=True on tar archives, tarfile.extractall is invoked without a proper filter, enabling path traversal and potential arbitrary file writes outside the destination directory. The root cause is linked to Python tarfile weakne...

CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

EUVD-2025-36731

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

node-tar 安全漏洞

node-tar is a package for file compression/decompression by isaacs individual developers. A security vulnerability exists in node-tar version 7.5.1, which stems from the return of uninitialized memory contents when reading the contents of a tar entry using .t, which could lead to information...

PT-2025-44433

Name of the Vulnerable Software and Affected Versions Keras affected versions not specified Description The keras.utils.get file API in Keras is susceptible to a path traversal issue when the extract=True option is used with tar archives. The utility employs Python’s tarfile.extractall function...

PT-2025-44446

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.2 Description node-tar is a Tar for Node.js. When using the .t also known as .list function with the sync: true option to read tar entry contents, uninitialized memory contents may be returned if the tar file is...

AZL-69002 CVE-2025-58183 affecting package cri-o 1.30.1-1

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69137 CVE-2025-58183 affecting package moby-engine for versions less than 24.0.9-19

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69033 CVE-2025-58183 affecting package containerized-data-importer for versions less than 1.55.0-26

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69134 CVE-2025-58183 affecting package containerized-data-importer for versions less than 1.57.0-17

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69302 CVE-2025-58183 affecting package moby-engine for versions less than 25.0.3-14

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-58183

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-68991 CVE-2025-58183 affecting package buildah 1.18.0-29

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69362 CVE-2025-58183 affecting package skopeo for versions less than 1.14.4-7

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-78907 CVE-2025-58183 affecting package golang 1.26.5-2

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69036 CVE-2025-58183 affecting package cri-o for versions less than 1.22.3-17

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...