{"action":"Upgrade tar to 3.2.3 or later.","affected":[{"fixed":"3.2.3","introduced":"3.0.0"},{"fixed":"4.4.15","introduced":"4.0.0"},{"fixed":"5.0.7","introduced":"5.0.0"},{"fixed":"6.1.2","introduced":"6.0.0"}],"component":"tar","cve_ids":["CVE-2021-32803"],"ecosystem":"npm","epss":0.07795,"exploited":false,"fixed_versions":["3.2.3","4.4.15","5.0.7","6.1.2"],"ghsa_id":"GHSA-r628-mhmh-qjhw","id":"tcs_01M5KG85TRG9G2X4TZ0QDTQKP0","modified_at":"2026-07-08T06:27:29.457953694Z","published_at":"2021-08-03T19:00:40Z","references":["https://osv.dev/vulnerability/GHSA-r628-mhmh-qjhw","https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","https://nvd.nist.gov/vuln/detail/CVE-2021-32803","https://github.com/isaacs/node-tar/commit/46fe35083e2676e31c4e0a81639dce6da7aaa356","https://github.com/isaacs/node-tar/commit/5987d9a41f6bfbf1ddab1098e1fdcf1a5618f571","https://github.com/isaacs/node-tar/commit/85d3a942b4064e4ff171f91696fced7975167349","https://github.com/isaacs/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20","https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/isaacs/node-tar","https://www.npmjs.com/advisories/1771","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-r628-mhmh-qjhw","url":"https://osv.dev/vulnerability/GHSA-r628-mhmh-qjhw"}],"summary":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning"}