Executive brief
nanotar is a JavaScript library used to parse and extract tar archives in Node.js applications. A path traversal vulnerability in its parsing functions allows attackers to write arbitrary files outside the intended extraction directory when processing a malicious tar archive, potentially overwriting system files or injecting malicious code.
Technical details
nanotar through version 0.2.0 contains a path traversal vulnerability (CWE-22) in the parseTar() and parseTarGzip() functions that fails to properly sanitize file paths extracted from tar archives. An attacker can craft a tar archive containing path traversal sequences (e.g., "../") that, when parsed, allow writing files to arbitrary locations on the filesystem outside the intended extraction directory. The vulnerability is triggered remotely when an application processes a malicious tar archive without additional validation. No authentication or user interaction is required beyond providing a crafted archive. A fix or updated version may be available; verification with the maintainer is recommended.
Affected products
- unjs nanotar through 0.2.0
Timeline
- 2026-02-11: disclosed
- 2026-02-11: advisory