CVE-2021-32804: Arbitrary File Creation/Overwrite in npm/tar
Summary
CVE-2021-32804: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization. Affects tar across 4 version ranges.
< 3.2.2
>= 4.0.0, < 4.4.14
>= 5.0.0, < 5.0.6
>= 6.0.0, < 6.1.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tar · Alpine:v3.16
The same CVE-2021-32804 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm/tar package is a popular open-source library used for creating and extracting tar archives in Node.js applications. It provides functionality to compress and decompress files and directories into tar format. However, a vulnerability has been discovered in versions prior to 3.2.2, 4.4.14, 5.0.6, and 6.1.1 that allows for arbitrary file creation and overwrite due to insufficient absolute path sanitization.
Vulnerability Detail
The vulnerability arises from the inadequate handling of absolute file paths with repeated path roots. When a tar file contains an absolute file path with multiple path roots (e.g., '////home/user/.bashrc'), the library fails to strip all the path roots, resulting in a resolved absolute path. This allows an attacker to create or overwrite arbitrary files on the system, potentially leading to arbitrary code execution. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.2.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.2.23.2.2npm install tar@3.2.2 -
>= 4.0.0, < 4.4.144.4.14npm install tar@4.4.14 -
>= 5.0.0, < 5.0.65.0.6npm install tar@5.0.6 -
>= 6.0.0, < 6.1.16.1.1npm install tar@6.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest patch versions is not feasible, users can implement a custom 'onentry' method or a 'filter' method to sanitize the entry paths and prevent the extraction of absolute paths. Here are two examples:
- Using the 'onentry' method:
const path = require('path')
const tar = require('tar')
tar.x({
file: 'archive.tgz',
onentry: (entry) => {
if (path.isAbsolute(entry.path)) {
entry.path = sanitizeAbsolutePathSomehow(entry.path)
entry.absolute = path.resolve(entry.path)
}
}
})
- Using the 'filter' method:
const path = require('path')
const tar = require('tar')
tar.x({
file: 'archive.tgz',
filter: (file, entry) => {
if (path.isAbsolute(entry.path)) {
return false
} else {
return true
}
}
})
Conclusion
The npm/tar package is vulnerable to arbitrary file creation and overwrite due to insufficient absolute path sanitization. To mitigate this vulnerability, it is crucial to upgrade to the latest patch versions or implement the provided workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tar →
FAQ
The npm/tar package is a widely used open-source library in Node.js applications that provides functionality for creating and extracting tar archives.
This vulnerability allows an attacker to create or overwrite arbitrary files on the system, potentially leading to arbitrary code execution.
To fix this vulnerability, it is recommended to upgrade to the latest patch versions of the npm/tar package (3.2.2, 4.4.14, 5.0.6, or 6.1.1).
Yes, if upgrading is not feasible, users can implement custom methods to sanitize entry paths or filter out entries with absolute paths.
This vulnerability is rated as HIGH with a CVSS score of 8.2.
References
Related vulnerabilities
Recent vulnerabilities recorded for tar.
