High Severity Path Traversal Vulnerability in tar-fs Package
Summary
CVE-2024-12905: tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File. Affects tar-fs across 3 version ranges.
< 1.16.4
>= 2.0.0, < 2.1.2
>= 3.0.0, < 3.0.7
Fixed in 1.16.4, 2.1.2 or 3.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- node-tar-fs · Debian:11
The same CVE-2024-12905 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tar-fs package is a Node.js library that provides a simple way to create and extract tar archives. It is widely used in various applications for handling file compression and decompression. However, the package has been found to be vulnerable to a serious issue that allows attackers to exploit the extraction process of crafted tar files, leading to unauthorized file access and potential system compromise.
Vulnerability Detail
The vulnerability in the tar-fs package is characterized by improper link resolution before file access, known as 'Link Following', and improper limitation of a pathname to a restricted directory, referred to as 'Path Traversal'. This issue arises when a maliciously crafted tar file is extracted, allowing attackers to write or overwrite files outside the intended extraction directory. The vulnerability affects versions of tar-fs prior to 1.16.4, 2.1.2, and 3.0.8, posing a significant risk to applications relying on this package.
How To Fix
Latest published version: 3.1.3 as of 23 Oct 2026
npm install tar-fs@3.1.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.16.41.16.4npm install tar-fs@1.16.4 -
>= 2.0.0, < 2.1.22.1.2npm install tar-fs@2.1.2 -
>= 3.0.0, < 3.0.73.0.7npm install tar-fs@3.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid extracting tar files from untrusted sources. Additionally, consider implementing file validation and sanitization processes to ensure that extracted files do not lead to unauthorized access.
Conclusion
The tar-fs package has a critical vulnerability that can lead to unauthorized file access when extracting crafted tar files. It is essential to update to the latest patched versions to protect your applications from potential exploitation. Additionally, using tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for tar-fs →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions of tar-fs are those before 1.16.4, 2.1.2, and 3.0.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability can lead to unauthorized file writes or overwrites, potentially compromising the integrity of the system and exposing sensitive data.
Yes, avoid extracting tar files from untrusted sources and implement file validation and sanitization to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for tar-fs.
