Design/Logic Flaw

The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...

CVE-2021-32803

The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...

UBUNTU-CVE-2021-32804

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

CVE-2021-32804

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

Design/Logic Flaw

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

CVE-2021-32804

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

UBUNTU-CVE-2021-32803

The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...

CVE-2021-32804

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

CVE-2021-32804

The CVE-2021-32804 entry concerns the npm package tar (node-tar). Affected versions before 6.1.1, 5.0.6, 4.4.14, and 3.3.2 contain an arbitrary File Creation/Overwrite vulnerability caused by insufficient absolute path sanitization during extraction. node-tar attempts to prevent absolute paths by...

CVE-2021-32804

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

CVE-2021-32804 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

The npm package "tar" aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when th...

@36node/sketch-cli (>=0.1.3, <=0.3.2), @adobe/commerce-cif-commercetools-cart (>=1.0.1, <=1.0.2) +321 more potentially affected by CVE-2021-32804 via tar (>=4.0.1, <=4.4.13)

tar NPM version =4.0.1, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2021-32804 Source advisory: OSV:GHSA-3JFQ-G458-7QM9...

@adaptable/client (>=0.0.9, <=1.26.0), @adaptable/cloud (>=0.0.1, <=1.28.0) +359 more potentially affected by CVE-2021-32804 via tar (>=6.0.0, <=6.1.0)

tar NPM version =6.0.0, =0.0.9, =0.0.1, =1.6.0, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.1.0, =0.6.5, =1.1.0, =1.0.0, =0.0.2, =0.1.0, =0.1.8 and more Source cves: CVE-2021-32804 Source advisory: OSV:GHSA-3JFQ-G458-7QM9...

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any...

GHSA-3JFQ-G458-7QM9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any...

@camptocamp/closure-util (>=1.23.0, <=1.27.0), @cognigy/wndb-with-exceptions (>=3.0.1, <=3.0.3) +97 more potentially affected by CVE-2021-32804 via tar (>=3.0.0, <=3.1.15)

tar NPM version =3.0.0, =1.23.0, =3.0.1, =1.36.0, =0.0.1, =1.0.0, =3.0.14, =4.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.1 and more Source cves: CVE-2021-32804 Source advisory: OSV:GHSA-3JFQ-G458-7QM9...

@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-32804 via tar (>=5.0.2, <=5.0.5)

tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-32804 Source advisory:...

CVE-2021-32803

CVE-2021-32803 concerns the npm package tar (node-tar) with an arbitrary File Creation/Overwrite vulnerability due to insufficient symlink protection when extracting tar files. The issue arises from a directory cache and mkdir-skip logic that can be bypassed when a directory and a symlink share t...

CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...

@36node/sketch-cli (>=0.1.3, <=0.3.2), @adobe/commerce-cif-commercetools-cart (>=1.0.1, <=1.0.2) +321 more potentially affected by CVE-2021-32803 via tar (>=4.0.1, <=4.4.13)

tar NPM version =4.0.1, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2021-32803 Source advisory: OSV:GHSA-R628-MHMH-QJHW...