Path Traversal Vulnerability in @vltpkg/tar Package
Summary
GHSA-gf2c-jwcj-x929: vlt Mishandles Path Sanitization for tar. Affects @vltpkg/tar versions < 1.0.0-rc.10. Fixed in 1.0.0-rc.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @vltpkg/tar package is a utility for handling tar file operations in Node.js applications. It provides functionalities for creating and extracting tar archives, making it a popular choice among developers for file management tasks. However, prior to version 1.0.0-rc.10, the package had a critical flaw in its path sanitization process during extraction, which could lead to security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the mishandling of path sanitization in the @vltpkg/tar package before version 1.0.0-rc.10. This flaw allows attackers to exploit path traversal vulnerabilities, enabling them to extract files to arbitrary locations on the filesystem. Such exploitation can lead to unauthorized access to sensitive files or system compromise, making it a significant security risk for applications utilizing this package.
How To Fix
Minimum fixed version
1.0.0-rc.10
This is the first release that contains the fix.
npm install @vltpkg/tar@1.0.0-rc.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing additional checks in your application to validate file paths before extraction. This can help mitigate the risk of path traversal attacks until you can apply the official patch.
Conclusion
The @vltpkg/tar package has a significant vulnerability related to path sanitization that can lead to path traversal attacks. It is crucial for developers using this package to update to version 1.0.0-rc.10 or later to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @vltpkg/tar →
FAQ
Path traversal is a security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized file access, data leakage, or even complete system compromise, depending on the permissions of the application.
Yes, the CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
Implement additional validation checks on file paths before extraction as a temporary workaround until you can update to the patched version.
