{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.2.0"}],"component":"nanotar","cve_ids":["CVE-2025-69874"],"ecosystem":"npm","epss":0.00935,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-92fh-27vv-894w","id":"tcs_01M5KFEEE5MQVE9WCC8QYS0PAG","modified_at":"2026-02-11T19:11:16.577195Z","published_at":"2026-02-11T18:31:30Z","references":["https://osv.dev/vulnerability/GHSA-92fh-27vv-894w","https://nvd.nist.gov/vuln/detail/CVE-2025-69874","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69874-nanotar-Path-Traversal.md","https://github.com/unjs/nanotar","https://www.npmjs.com/package/nanotar"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-92fh-27vv-894w","url":"https://osv.dev/vulnerability/GHSA-92fh-27vv-894w"}],"summary":"nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()"}