CVE-2026-59875

Katalog CVE

CVSS 5.3 · Medium EPSS 0,51%

Kerentanan Uncaught Exception. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

10 Juli 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3
• https://github.com/isaacs/node-tar/releases/tag/v7.5.17
• https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j