CVE-2025-59343
1 advisory.
npm/tar-fs CVE-2025-59343: high, EPSS 0.55%
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
Action: Upgrade tar-fs to 1.16.6 or later.
npm i tar-fs@3.1.1npm i tar-fs@2.1.4npm i tar-fs@1.16.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.1.1 | - |
| 2.0.0 | 2.1.4 | - |
| 0 | 1.16.6 | - |
Fixed versions
| 3.1.1 | 2.1.4 | 1.16.6 |
Sources
- osv: GHSA-vj76-c3g6-qr5v
- https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
- https://nvd.nist.gov/vuln/detail/CVE-2025-59343
- https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
- https://github.com/mafintosh/tar-fs
- https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html
CVE-2025-59343 · published · modified · JSON