CVE-2024-12905
1 advisory.
npm/tar-fs CVE-2024-12905: high 7.5
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Action: Upgrade tar-fs to 1.16.4 or later.
npm i tar-fs@1.16.4npm i tar-fs@2.1.2npm i tar-fs@3.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.16.4 | - |
| 2.0.0 | 2.1.2 | - |
| 3.0.0 | 3.0.7 | - |
Fixed versions
| 1.16.4 | 2.1.2 | 3.0.7 |
Sources
- osv: GHSA-pq67-2wwv-3xjx
- https://nvd.nist.gov/vuln/detail/CVE-2024-12905
- https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed
- https://arxiv.org/abs/2506.04962
- https://arxiv.org/pdf/2506.04962
- https://github.com/mafintosh/tar-fs
- https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html
- https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs
CVE-2024-12905 · published · modified · JSON