6152 matches found
CVE-2026-64824
CVE-2026-64824 affects Home Assistant Core prior to 2026.6.0. A path-traversal flaw exists in the backup-restore function that can write files to arbitrary absolute filesystem paths via a crafted tar archive using a SYMTYPE entry with a benign member name and an absolute linkname outside the extr...
EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-2873)
According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...
Oracle Linux 10 : vim (ELSA-2026-38509)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38509 advisory. - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with...
vim security update
9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...
CVE-2026-59875
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:12+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j 2026-07-22 12:01:16+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmsdhlk24...
CVE-2026-59871
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:05+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp 2026-07-22 12:01:14+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmqeztj2n...
EUVD-2026-42308
node-tar: Process crash via PAX numeric path type confusion...
@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +908 more potentially affected by CVE-2026-59871 via tar (>=7.0.0, <=7.5.17)
tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59871 Source advisory: OSV:GHSA-W8WR-V893-VJVP...
GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion
Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...
GHSA-23HP-3JRH-7FPW node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +913 more potentially affected by CVE-2026-59873 via tar (>=7.0.0, <=7.5.18)
tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59873 Source advisory: OSV:GHSA-23HP-3JRH-7FPW...
node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
NPM: node-tar: Decompression/parse DoS via unlimited input
NPM: node-tar: Decompression/parse DoS via unlimited input vulnerability discovered by ? in WordPress Npm tar versions = 7.5.18...
EUVD-2026-42305
node-tar: Decompression/parse DoS via unlimited input...
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...
node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
GHSA-8X88-C5MF-7J5W node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +908 more potentially affected by CVE-2026-59874 via tar (>=7.0.0, <=7.5.17)
tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59874 Source advisory: OSV:GHSA-8X88-C5MF-7J5W...
GHSA-GVWX-54WH-QM9J node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
Summary node-tar strips trailing NUL bytes from long-name L and long-linkpath K GNU extended headers but does not apply the same sanitization to equivalent fields delivered via PAX x typeflag extended headers. A PAX record of the form path=visible.txt\x00hidden.txt is parsed verbatim into...