CVE-2025-48387
1 advisory.
npm/tar-fs CVE-2025-48387: high, EPSS 0.58%
tar-fs can extract outside the specified dir with a specific tarball
Action: Upgrade tar-fs to 1.16.5 or later.
npm i tar-fs@1.16.5npm i tar-fs@2.1.3npm i tar-fs@3.0.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.16.5 | - |
| 2.0.0 | 2.1.3 | - |
| 3.0.0 | 3.0.9 | - |
Fixed versions
| 1.16.5 | 2.1.3 | 3.0.9 |
Sources
- osv: GHSA-8cj5-5rvv-wf4v
- https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w
- https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v
- https://nvd.nist.gov/vuln/detail/CVE-2025-48387
- https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f
- https://github.com/mafintosh/tar-fs
- https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html
CVE-2025-48387 · published · modified · JSON