Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

EUVD-2026-53368

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. A crafted tar archive containing member names with ../ path component...

RLSA-2026:47057 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malform...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

SUSE CVE-2026-9538

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. readtar reads each entry's payload with $handle-read$$data, $block, where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that...

SUSE CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAllnameInArchive, "", "/", which turns a POSIX filename such as ....\evil.sh into the...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...

EUVD-2026-50408

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...

CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...

CVE-2026-54574

CVE-2026-54574 affects proot-distro prior to 5.1.5. The flaw resides in extraction paths: _extract_plain_tar() (proot_distro/commands/install.py) and _apply_layer() (proot_distro/helpers/docker.py) do not validate symlink targets (member.linkname). A tar archive can plant an absolute host-path sy...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in @rootio/tar - Patched by Root

Root has patched CVE-2026-59875 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAllnameInArchive, "", "/", which turns a POSIX filename such as ....\evil.sh into the...

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

...

DEBIAN-CVE-2026-12482

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

CVE-2026-12482

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

Linux Distros Unpatched Vulnerability : CVE-2026-12482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in...