CVE-2025-69874: nanotar Path Traversal Vulnerability in parseTar() and parseTarGzip()
Summary
CVE-2025-69874: nanotar is vulnerable to path traversal in parseTar() and parseTarGzip(). Affects nanotar versions < 0.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nanotar is an npm package designed for handling tar and gzip file formats, allowing users to extract and manipulate archived files efficiently. It is widely used in various applications for its simplicity and effectiveness in managing compressed data. However, a significant security flaw has been identified in versions up to 0.2.0, which exposes users to potential risks from maliciously crafted tar archives.
Vulnerability Detail
The vulnerability in nanotar arises from improper validation of file paths during the extraction process in the parseTar() and parseTarGzip() functions. This flaw allows remote attackers to exploit path traversal sequences, enabling them to write arbitrary files outside the intended extraction directory. As a result, an attacker could potentially overwrite critical system files or introduce malicious files into the system, leading to severe security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation to sanitize file paths before processing tar archives. This can be done by checking for path traversal sequences (like '../') and rejecting any files that attempt to exploit this vulnerability.
Conclusion
The path traversal vulnerability in nanotar poses a significant risk to users, allowing attackers to exploit the package for malicious purposes. It is essential to update to the latest version to safeguard against potential threats. Implementing additional input validation can also help mitigate risks until an update is applied.
See every vulnerability recorded for nanotar →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized file access or modification.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in your software without requiring any installation.
If exploited, this vulnerability could allow attackers to overwrite critical files, introduce malicious content, or compromise the integrity of the system, leading to data loss or unauthorized access.
Yes, users should update to a version of nanotar higher than 0.2.0 to ensure they are protected against this vulnerability.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
