CVE-2025-64118

node-tar is a Tar for Node.js. In 7.5.1, using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2...

CVE-2025-64118

The CVE-2025-64118 issue affects node-tar (Tar for Node.js). In version 7.5.1, reading tar entries with .t/.list using { sync: true } can return uninitialized memory if the tar file is changed on disk to a smaller size during read. This memory contents exposure is fixed in version 7.5.2. The vuln...

Directory Traversal

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Directory Traversal via the keras.utils.getfile API when the extract=True option is used for tar archives. An attacker can write arbitrary files to any location on the...

AZL-69472 CVE-2025-12060 affecting package keras for versions less than 3.3.3-5

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

UBUNTU-CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

Race Condition

Overview tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Race Condition in the tar.t function, also known as tar.list, when the sync: true option is used and the underlying tar file is truncated on disk to a smaller size between the time its size is...

node-tar has a race condition leading to uninitialized memory exposure

Summary Using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. Details See: https://github.com/isaacs/node-tar/issues/445 https://github.com/isaacs/node-tar/pull/446 Regression happene...

GHSA-29XP-372Q-XQPH node-tar has a race condition leading to uninitialized memory exposure

Summary Using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. Details See: https://github.com/isaacs/node-tar/issues/445 https://github.com/isaacs/node-tar/pull/446 Regression happene...

@adobe/helix-deploy-plugin-edge (>=1.1.10, <=1.1.16), @cyclonedx/cdxgen (>=11.9.0, <=11.11.0) +22 more potentially affected by CVE-2025-64118 via tar (7.5.1)

tar NPM version 7.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tar and may be impacted: - @adobe/helix-deploy-plugin-edge =1.1.10, =11.9.0, =2.0.27, =5.0.51, =0.45.2, =1.0.0-beta.2, =0.3.1, =4.4.2, =1.9.0, =1.6.1, =0.0.11, =1.0.1, =0.1.0, =0.2.2...

@adobe/helix-deploy-plugin-edge (>=1.1.10, <=1.1.16), @cyclonedx/cdxgen (>=11.9.0, <=11.11.0) +22 more potentially affected by CVE-2025-64118 via tar (7.5.1)

tar NPM version 7.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tar and may be impacted: - @adobe/helix-deploy-plugin-edge =1.1.10, =11.9.0, =2.0.27, =5.0.51, =0.45.2, =1.0.0-beta.2, =0.3.1, =4.4.2, =1.9.0, =1.6.1, =0.0.11, =1.0.1, =0.1.0, =0.2.2...

CVE-2025-12060

CVE-2025-12060 concerns Keras: when using keras.utils.get_file with extract=True on tar archives, tarfile.extractall is invoked without a proper filter, enabling path traversal and potential arbitrary file writes outside the destination directory. The root cause is linked to Python tarfile weakne...

CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

EUVD-2025-36731

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

node-tar 安全漏洞

node-tar is a package for file compression/decompression by isaacs individual developers. A security vulnerability exists in node-tar version 7.5.1, which stems from the return of uninitialized memory contents when reading the contents of a tar entry using .t, which could lead to information...

PT-2025-44433

Name of the Vulnerable Software and Affected Versions Keras affected versions not specified Description The keras.utils.get file API in Keras is susceptible to a path traversal issue when the extract=True option is used with tar archives. The utility employs Python’s tarfile.extractall function...

PT-2025-44446

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.2 Description node-tar is a Tar for Node.js. When using the .t also known as .list function with the sync: true option to read tar entry contents, uninitialized memory contents may be returned if the tar file is...

AZL-69033 CVE-2025-58183 affecting package containerized-data-importer for versions less than 1.55.0-26

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69302 CVE-2025-58183 affecting package moby-engine for versions less than 25.0.3-14

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

AZL-69002 CVE-2025-58183 affecting package cri-o 1.30.1-1

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...