PT-2026-49577 · Npm · Node-Tar
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
node-tar versions prior to 7.5.16
Description
An interpretation differential exists in how the software parses tar archives. The issue occurs because the library applies a PAX extended header's
size= record (and other PAX overrides) to the next header entry regardless of its type. According to POSIX pax standards, a PAX extended header (x) should describe the next file entry, not intermediary extension headers such as GNU long-name (L) or long-link (K) entries.By allowing the PAX
size to override the byte length of an intervening L, K, or x header, an attacker can desynchronize the stream cursor. This results in a discrepancy where a single crafted archive is interpreted differently by node-tar compared to other mainstream implementations like GNU tar, libarchive/bsdtar, and Python tarfile. This behavior can be exploited to hide archive members from security scanners that use one parser while the final extraction is performed by another, potentially bypassing malware or secret detection tools.Recommendations
Update to version 7.5.16.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Node-Tar