CVE-2021-37701: Arbitrary File Creation/Overwrite in tar
Summary
CVE-2021-37701: Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. Affects tar across 3 version ranges.
>= 3.0.0, < 4.4.16
>= 5.0.0, < 5.0.8
>= 6.0.0, < 6.1.7
Fixed in 4.4.16, 5.0.8 or 6.1.7, depending on the release line you run. How to fix ↓
Also tracked for
- nodejs · Alpine:v3.11
The same CVE-2021-37701 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'tar' package is an npm module that provides functionality for creating and extracting tar archives. It is widely used in Node.js applications to handle file compression and decompression. However, a vulnerability has been discovered in versions prior to 4.4.16, 5.0.8, and 6.1.7 that allows for arbitrary file creation, overwrite, and potential code execution.
Vulnerability Detail
The vulnerability arises from insufficient symlink protection and directory cache poisoning using symbolic links. The 'node-tar' module, which is used by 'tar', is designed to prevent the extraction of files whose location would be modified by a symbolic link. However, this logic was flawed when extracting tar files containing both a directory and a symlink with the same name as the directory. By creating a directory and then replacing it with a symlink, an attacker could bypass the symlink checks and extract arbitrary files into any location, leading to arbitrary file creation, overwrite, and potential code execution. The issue also affects case-insensitive filesystems, where a directory can be mistakenly removed due to the creation of a symbolic link with a similar name.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 4.4.164.4.16npm install tar@4.4.16 -
>= 5.0.0, < 5.0.85.0.8npm install tar@5.0.8 -
>= 6.0.0, < 6.1.76.1.7npm install tar@6.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
const tar = require('tar')
tar.x({
file: 'archive.tgz',
filter: (file, entry) => {
if (entry.type === 'SymbolicLink') {
return false
} else {
return true
}
}
})
Conclusion
The 'tar' package prior to versions 4.4.16, 5.0.8, and 6.1.7 is vulnerable to arbitrary file creation, overwrite, and potential code execution. It is crucial to upgrade to the latest patched versions or implement the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tar →
FAQ
The vulnerability allows an attacker to create or overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or code execution.
Versions prior to 4.4.16, 5.0.8, and 6.1.7 are affected by this vulnerability.
Yes, a workaround is available by implementing a custom filter method that prevents the extraction of symbolic links. The provided code snippet demonstrates this workaround.
Yes, the vulnerability has been addressed in versions 4.4.16, 5.0.8, and 6.1.7 of the 'tar' package.
Yes, it is recommended to normalize paths using a well-tested method such as 'path.resolve()' before comparing them, as the 'node-tar' module now uses '/' as the path separator on all systems.
Related vulnerabilities
Recent vulnerabilities recorded for tar.
