An open index of dependabot pull requests across open source projects.

tar

Ecosystem:
npm
Package URL:
pkg:npm/tar
Total PRs:
13,181 Dependabot PRs
Latest PR:
about 3 hours ago
Unique Repositories:
10,085 repositories
Unique Repos (30 days):
1,909 repositories
Security Advisories
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
GHSA-8qq5-rm4j-mr97 CVE-2026-23745 HIGH published about 2 months ago • updated 7 days ago
### Summary The `node-tar` library (`<= 7.5.2`) fails to sanitize the `linkpath` of `Link` (hardlink) and `SymbolicLink` entries when `preservePat...
tar has Hardlink Path Traversal via Drive-Relative Linkpath
GHSA-qffp-2rhf-9h96 HIGH published 6 days ago • updated 6 days ago
### Summary `tar` (npm) can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target ...
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
GHSA-qq89-hq3f-393p CVE-2021-37712 HIGH published over 4 years ago • updated 1 day ago
### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location wou...
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
GHSA-5955-9wpr-37jh CVE-2021-37713 HIGH published over 4 years ago • updated 1 day ago
### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location wo...
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
GHSA-83g3-92jg-28cx CVE-2026-26960 HIGH published 21 days ago • updated 7 days ago
### Summary `tar.extract()` in Node `tar` allows an attacker-controlled archive to create a hardlink inside the extraction directory that points to...
Recent PRs (filtered by: Patch PRs )
Bump tar from 7.5.9 to 7.5.11

johnhelmuth/cluster-map #105

7.5.9 → 7.5.11 Patch PR
Open about 24 hours ago 2 comments
johnhelmuth
Bump tar from 7.5.9 to 7.5.10

hashintel/hash #8516

7.5.9 → 7.5.10 Patch PR
Open 4 days ago 4 comments
hashintel
Package Details
Name: tar
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/tar
JSON API: View JSON
Security Advisories

13

Active advisories
HIGH 12
MODERATE 1
View All npm Advisories
Package Information
Description:

tar for node

Repository: https://github.com/isaacs/node-tar
Homepage: https://github.com/isaacs/node-tar#readme
Latest Release: 7.4.3
over 1 year ago
Dependent Repos: 3,179,743
Dependent Packages: 5,040
Downloads: 170,210,137
Ranking: Top 0.0051% by dependent repos Top 0.0126% by downloads Top 0.0176% by dependent pkgs
PR Status
Open 5,336 (40.5%)
Merged 321 (2.4%)
Closed 7,363 (55.9%)
PR Types
Removal 1,203 (9.1%)
Minor 4,285 (32.5%)
Major 2,186 (16.6%)
Patch 5,146 (39.0%)