Is CVE-2024-12905 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-12905 being exploited in the wild.

How severe is CVE-2024-12905?

Low severity, with a CVSS score of 3.1, published 27 March 2025.

Which products and versions are affected?

tar-fs (npm) SEMVER:introduced=0,fixed=1.16.4.

Is there a fix for CVE-2024-12905?

Yes. tar-fs (npm): upgrade to 1.16.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-12905 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-12905?

Check whether you run tar-fs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-12905: tar-fs path traversal and symlink following in extraction

CVE-2024-12905 · Severity: low · CVSS 3.1 · Published 2025-03-27

tar-fs is a Node.js library for creating and extracting tar archives. A vulnerability allows attackers to write files outside the intended extraction directory when processing a maliciously crafted tar file, potentially overwriting critical system files or application code. This could lead to unauthorized data modification, application compromise, or system-level attacks on any service using tar-fs to extract untrusted archives.

Technologies: tar-fs (npm). Vendors: npm.

Quick answers

Is CVE-2024-12905 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-12905 being exploited in the wild.
How severe is CVE-2024-12905?: Low severity, with a CVSS score of 3.1, published 27 March 2025.
Which products and versions are affected?: tar-fs (npm) SEMVER:introduced=0,fixed=1.16.4.
Is there a fix for CVE-2024-12905?: Yes. tar-fs (npm): upgrade to 1.16.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-12905 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-12905?: Check whether you run tar-fs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tar-fs (npm): upgrade to 1.16.4 or later
```
npm install tar-fs@1.16.4
```

Technical details

The vulnerability is an improper link resolution before file access (CWE-22) and path traversal issue in tar-fs's index.js. When extracting a crafted tar archive, the library fails to properly validate symlinks and sanitize extraction paths, allowing entries with absolute paths or specially crafted names to be written outside the intended target directory. The flaw affects versions 0.0.0–1.16.3, 2.0.0–2.1.1, and 3.0.0–3.0.6. An attacker needs only to provide a malicious tar file to an application that calls tarfs.extract() without strict path validation; no authentication or special privileges are required. Exploitation can result in arbitrary file writes or overwrites. Patches have been released in versions 1.16.4, 2.1.2, and 3.0.7.

Affected products

tar-fs tar-fs 0.0.0 to <1.16.4; 2.0.0 to <2.1.2; 3.0.0 to <3.0.7

Identifiers

CVE-2024-12905
GHSA-pq67-2wwv-3xjx

Timeline

2025-03-27: disclosed
2025-03-27: patched: Patches released in versions 1.16.4, 2.1.2, and 3.0.7

References

https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.