fix: CVE-2026-23745 - update tar to ^7.5.3 #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

jonshilton wants to merge 1 commit into main from fix/sqd-1052-cve-2026-23745-node-tar-is-vulnerable-to-arbitrary-file

+7 −53

jonshilton commented Jan 27, 2026

Summary

This PR resolves CVE-2026-23745 - Arbitrary File Overwrite and Symlink Poisoning in the tar package.

Vulnerability Details

CVE: CVE-2026-23745
Affected versions: <= 7.5.2

Changes

Updated yarn.lock to resolve tar@^7.5.3
The vulnerable tar is no longer in the dependency tree

Linear Issue

https://linear.app/multiverse-io/issue/SQD-1052/cve-2026-23745-node-tar-is-vulnerable-to-arbitrary-file-overwrite-and


          ix: CVE-2026-23745 - update tar to ^7.5.3

ce3bd2e

linear bot commented Jan 27, 2026

SQD-1052 CVE-2026-23745: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

jonshilton requested a review from DanielO15

January 27, 2026 11:15

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet