GitHub Advisoryadvisory · npm

GHSA-92fh-27vv-894w nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()

MEDIUM Published 2026-02-11 Modified 2026-02-11 Official page ↗
Aliases
CVE-2025-69874
Ecosystem
npm
Packages
nanotar
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2026-02-11

Affected packages

• npm nanotar: <= 0.2.0 (no fix yet)

Description

nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.

Related

Alias · CVE (1)

  • CVE-2025-69874 nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References