Platform
nodejs
Component
tar-fs
Fixed in
3.0.1
2.0.1
1.16.6
3.1.1
CVE-2025-59343 is a directory traversal vulnerability discovered in the tar-fs component. This flaw could allow an attacker to access files and directories outside the intended extraction path, potentially leading to sensitive data exposure. The vulnerability affects versions 3.1.0, 2.1.3, and 1.16.5 and earlier. Patches are available for versions 3.1.1, 2.1.4, and 1.16.6.
CVE-2025-59343 affects the tar-fs filesystem, carrying a CVSS score of 7.5, indicating a moderately high risk. Versions prior to 3.1.1, such as 3.1.0, 2.1.3, and 1.16.5, are susceptible to this vulnerability. The issue stems from how tar-fs handles certain file types, potentially allowing for malicious code execution or data manipulation. Successful exploitation could lead to a loss of confidentiality, integrity, or availability of affected systems. Upgrading to a patched version is crucial to mitigate this risk.
The vulnerability is exploited through manipulation of tar files. An attacker could craft a malicious tar file containing entries designed to trigger the vulnerable behavior in tar-fs. Exploitation could involve injecting malicious code or modifying existing files. The exploitation context depends on the environment where tar-fs is used and the attacker's permissions. It's important to review and validate tar files before extracting them, especially if they originate from untrusted sources.
Exploit Status
EPSS
0.03% (8% percentile)
CISA SSVC
The definitive solution is to upgrade to version 3.1.1, 2.1.4, or 1.16.6, which include the fix for CVE-2025-59343. As a temporary workaround, you can implement the 'ignore' option. This option allows filtering files that are neither files nor directories, preventing potential exploitation. The provided JavaScript code illustrates how to implement this workaround, blocking the processing of unwanted file types. Applying this workaround is recommended while completing the upgrade to the patched version.
Actualice la biblioteca tar-fs a la versión 3.1.1, 2.1.4 o 1.16.6, o superior. Esto corrige la vulnerabilidad de omisión de validación de enlaces simbólicos. Como alternativa, utilice la opción `ignore` para excluir archivos y directorios no esenciales.
Vulnerability analysis and critical alerts directly to your inbox.
Versions prior to 3.1.1, including 3.1.0, 2.1.3, and 1.16.5, are vulnerable to CVE-2025-59343.
No, the 'ignore' option is a temporary solution. The permanent solution is to upgrade to a patched version (3.1.1, 2.1.4, or 1.16.6).
Check the version of tar-fs you are using. If it is older than the patched versions, it is vulnerable.
Not patching this vulnerability could allow an attacker to execute malicious code, modify data, or compromise system security.
You can find more information about CVE-2025-59343 in vulnerability databases and security advisories from tar-fs providers.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.