Executive brief
@vltpkg/tar is a package extraction utility used by developers to unpack tar archives. A flaw in path sanitization allows attackers to write files outside the intended extraction directory during archive extraction, potentially overwriting critical system or application files.
Technical details
A path traversal vulnerability (CWE-23) exists in the @vltpkg/tar package where the path sanitization logic fails to properly validate archive member paths during extraction. An attacker can craft a malicious tar archive containing path traversal sequences (e.g., symbolic links or absolute paths) to write files outside the intended extraction directory. The vulnerability requires local access and unusual conditions (AC:H), but allows arbitrary file writes with impact to integrity across the system (S:C). The fix was implemented in version 1.0.0-rc.10, incorporating path sanitization inspired by node-tar.
Affected products
- vlt @vltpkg/tar before 1.0.0-rc.10
Timeline
- 2026-01-28: disclosed: Published in GitHub Advisory Database
- 2026-01-27: exploited
- 2026-01-28: patched: Fixed in v1.0.0-rc.10