Symlink Validation Bypass Vulnerability in node-tar-fs Package
Summary
UBUNTU-CVE-2025-59343: tar-fs provides filesystem bindings for tar-stream. Affects node-tar-fs versions 2.1.1-2 – 2.1.1-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-tar-fs package provides filesystem bindings for tar-stream, allowing users to work with tar archives in a Node.js environment. It is commonly used for handling file operations in applications that require the manipulation of tar files. However, certain versions of this package are vulnerable to a symlink validation bypass, which can lead to unauthorized file access or overwriting of files in predictable directories.
Vulnerability Detail
The vulnerability arises from the way node-tar-fs handles symlink validation when extracting files from tarballs. If the destination directory is predictable, an attacker can exploit this flaw to bypass symlink validation, potentially leading to unauthorized access or modification of files. This issue affects versions prior to 3.1.1, 2.1.3, and 1.16.5, and has been assigned the identifier CVE-2025-59343. The ramifications of this vulnerability can be severe, especially in environments where sensitive data is stored in predictable paths.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can utilize the 'ignore' option when extracting files to prevent the extraction of non-file or non-directory entries. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The node-tar-fs package has a critical vulnerability that can lead to symlink validation bypass, posing risks to file security. It is essential for users to update to the latest patched versions to protect their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for node-tar-fs →
FAQ
node-tar-fs is a Node.js package that provides filesystem bindings for tar-stream, enabling users to work with tar files in their applications.
This vulnerability allows attackers to bypass symlink validation, potentially leading to unauthorized access or overwriting of files in predictable directories.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to this issue.
If an immediate update is not possible, consider using the 'ignore' option when extracting files as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for node-tar-fs.
