GitHub finds 7 code execution vulnerabilities in 'tar' and npm CLI

Опубликовано: 07 Март 2026
на канале: CSI digital

120

GitHub finds 7 code execution vulnerabilities in 'tar' and npm CLI

originally post : https://www.bleepingcomputer.com/news...

GitHub security team has identified several high-severity vulnerabilities in npm packages, "tar" and "@npmcli/arborist," used by npm CLI.

The tar package receives 20 million weekly downloads on average, whereas arborist gets downloaded over 300,000 times every week.

The vulnerabilities affect both Windows and Unix-based users, and if left unpatched, can be exploited by attackers to achieve arbitrary code execution on a system installing untrusted npm packages.

Between July and August this year, security researchers and bug bounty hunters Robert Chen and Philip Papurt identified arbitrary code execution vulnerabilities in the open-source Node.js packages, tar and @npmcli/arborist.

On discovery of these vulnerabilities, the researchers privately notified npm via one of GitHub's bug bounty programs.

On further review of the researchers' reports, GitHub security team found some more high-severity vulnerabilities in the aforementioned packages, affecting both Windows and Unix-based systems.

Node.js package tar remains a core dependency for installers that need to unpack npm packages post-installation. The package is also used by thousands of other open source projects, and as such receives roughly 20 million downloads every week. The arborist package is a core dependency relied on by npm CLI and is used to manage node_modules trees.

These ZIP slip vulnerabilities pose a problem for developers installing untrusted npm packages using the npm CLI, or using "tar" to extract untrusted packages.

By default, npm packages are shipped as .tar.gz or .tgz files which are ZIP-like archives and as such need to be extracted by the installation tools.

The tools extracting these archives should, ideally, ensure any malicious paths within the archive don't end up overwriting existing files, especially the sensitive ones, on the filesystem.

Why is this a security issue?
The npm CLI aims to enforce certain security boundaries on package installation. One of these boundaries is that a package’s contents will only be written to the appropriate folder within the node_modules directory hierarchy. Several of the tar and @npmcli/arborist vulnerabilities will cross that security boundary and may result in unexpected arbitrary file overwrites and subsequent code execution when installing untrusted packages.
tar itself has thousands of dependents beyond the npm CLI and is downloaded tens of millions of times weekly. These dependents may also use tar to extract potentially untrusted tar archives.

So, because of the vulnerabilities listed below, the npm package when extracted could overwrite arbitrary files with the privileges of the user running the npm install command:

• CVE-2021-32803
• CVE-2021-32804
• CVE-2021-37701
• CVE-2021-37712
• CVE-2021-37713
• CVE-2021-39134
• CVE-2021-39135

"CVE-2021-32804, CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135 specifically have a security impact on the npm CLI when processing a malicious or untrusted npm package install," explains Mike Hanley, Chief Security Officer at GitHub.

"Some of these issues may result in arbitrary code execution, even if you are using --ignore-scripts to prevent the processing of package lifecycle scripts."

GitHub Security team thanked both Chen and Papurt for their responsible disclosure and awarded them a total bounty of $14,500 for their efforts in keeping GitHub secure.

npm, owned by GitHub, is also prompting developers to fix these vulnerabilities ASAP in a tweet.

Developers should upgrade their tar dependency versions to 4.4.19, 5.0.11, or 6.1.10, and upgrade @npmcli/arborist version 2.8.2 to patch the vulnerabilities.

For npm CLI, versions v6.14.15, v7.21.0, or newer contain the fix. Additionally, Node.js version 12, 14, or 16 come with the fixed tar version and can be safely upgraded to, according to GitHub.