Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

isaacs/node-tar

              main @ 9cbdb31
            

Fixes

CVEs

HIGH

Peak severity

45.5%

Coverage

Highlights

Path Traversal: 12 prior fixes. Scrutinize any change in this area.

src/unpack.ts: most-fixed (5 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The extraction mechanism has repeatedly suffered from path validation escapes involving Windows drive-relative paths, hard links containing dot-dot sequences, and intermediate symbolic link target resolution.

Path Traversal: Extraction paths on Windows systems bypass directory boundaries when handling drive-relative/local paths or utilizing Unicode/8.3 shortnames to circumvent directory cache checks.

Path Traversal: Parsing of PAX extended headers could be manipulated to apply metadata overrides to non-standard entry types, creating parser interpretation differentials and file smuggling hazards.