Executive brief
tar-fs is a Node.js library that extracts tar archives to disk. A vulnerability allows a malicious tarball to write files outside the specified extraction directory by exploiting inadequate symlink validation. An attacker can craft a tar file that creates symlinks and hard links to escape the intended directory boundary and overwrite arbitrary files on the system where the extraction occurs.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in symlink and hardlink handling. The root cause is that tar-fs validates symlink targets using path.resolve() without resolving actual symlinks already present in the filesystem, allowing relative ".." sequences to escape validation. An attacker can craft a tar with nested symlinks (e.g., "noop" linking to ".") and relative paths that chain together to point outside the extraction root. Once a symlink escapes the boundary, hard links can be created through that symlink to overwrite files anywhere on the same filesystem. The attack requires only the ability to provide a malicious tarball to tar-fs's extract() function; no authentication or user interaction is needed beyond calling the vulnerable function. Patches are available in versions 1.16.5, 2.1.3, and 3.0.9.
Affected products
- mafintosh tar-fs <1.16.5, <2.1.3, <3.0.9
Timeline
- 2025-06-02: disclosed: Advisory GHSA-8cj5-5rvv-wf4v published
- 2025-06-02: patched: Fixed in versions 1.16.5, 2.1.3, 3.0.9
- 2025-06-03: other: OSV database entry published