CVE-2021-37701: Arbitrary File Creation/Overwrite in tar
Summary
Your scan reports tar 4.4.13. Fixed in 4.4.16.
CVE-2021-37701: Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. Affects tar across 3 version ranges.
>= 3.0.0, < 4.4.16
>= 5.0.0, < 5.0.8
>= 6.0.0, < 6.1.7
Fixed in 4.4.16. How to fix ↓
Also tracked for
- nodejs · Alpine:v3.11
The same CVE-2021-37701 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Background
The 'tar' package is an npm module that provides functionality for creating and extracting tar archives. It is widely used in Node.js applications to handle file compression and decompression. However, a vulnerability has been discovered in versions prior to 4.4.16, 5.0.8, and 6.1.7 that allows for arbitrary file creation, overwrite, and potential code execution.
Vulnerability Detail
The vulnerability arises from insufficient symlink protection and directory cache poisoning using symbolic links. The 'node-tar' module, which is used by 'tar', is designed to prevent the extraction of files whose location would be modified by a symbolic link. However, this logic was flawed when extracting tar files containing both a directory and a symlink with the same name as the directory. By creating a directory and then replacing it with a symlink, an attacker could bypass the symlink checks and extract arbitrary files into any location, leading to arbitrary file creation, overwrite, and potential code execution. The issue also affects case-insensitive filesystems, where a directory can be mistakenly removed due to the creation of a symbolic link with a similar name.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.16
This is the first release that contains the fix.
npm install tar@4.4.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
const tar = require('tar')
tar.x({
file: 'archive.tgz',
filter: (file, entry) => {
if (entry.type === 'SymbolicLink') {
return false
} else {
return true
}
}
})
Conclusion
The 'tar' package prior to versions 4.4.16, 5.0.8, and 6.1.7 is vulnerable to arbitrary file creation, overwrite, and potential code execution. It is crucial to upgrade to the latest patched versions or implement the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tar →
FAQ
The vulnerability allows an attacker to create or overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or code execution.
Versions prior to 4.4.16, 5.0.8, and 6.1.7 are affected by this vulnerability.
Yes, a workaround is available by implementing a custom filter method that prevents the extraction of symbolic links. The provided code snippet demonstrates this workaround.
Yes, the vulnerability has been addressed in versions 4.4.16, 5.0.8, and 6.1.7 of the 'tar' package.
Yes, it is recommended to normalize paths using a well-tested method such as 'path.resolve()' before comparing them, as the 'node-tar' module now uses '/' as the path separator on all systems.
Related vulnerabilities
Recent vulnerabilities recorded for tar.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.