GitHub Advisoryadvisory · npm

GHSA-x2mc-8fgj-3wmr Improper Input Validation in tar-fs

HIGH Published 2019-05-01 Modified 2021-08-03 Official page ↗
Aliases
CVE-2018-20835
Ecosystem
npm
Packages
tar-fs
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2019-05-01

Affected packages

• npm tar-fs: < 1.16.2 → fixed in 1.16.2

Description

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

Related

Alias · CVE (1)

  • CVE-2018-20835 A vulnerability was found in tar-fs before 1.16.2. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References