GitHub Advisoryadvisory · npm
GHSA-gf2c-jwcj-x929 vlt Mishandles Path Sanitization for tar
MEDIUM
Official page ↗
- Aliases
- CVE-2026-24909
- Ecosystem
- npm
- Packages
- @vltpkg/tar
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
- Weaknesses
- CWE-23
- Reviewed
- 2026-01-28
Affected packages
• npm @vltpkg/tar: < 1.0.0-rc.10 → fixed in 1.0.0-rc.10
Description
vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.
Related
Alias · CVE (1)
- CVE-2026-24909 vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction. vulnerability
Weakness · CWE (1)
- CWE-23 Relative Path Traversal weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-24909 advisory
- https://github.com/vltpkg/vltpkg/pull/1334 web
- https://github.com/vltpkg/vltpkg/commit/ff8d4099a1929772cea2adf131285e90ede6b0dd web
- https://github.com/vltpkg/vltpkg package
- https://github.com/vltpkg/vltpkg/releases/tag/v1.0.0-rc.10 web
- https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act web
- https://www.scworld.com/news/six-javascript-zero-day-bugs-lead-to-fears-of-supply-chain-attack web