critical9.8
CVE-2025-69874
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
Impact
nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nanotar | <= 0.2.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unjs | Nanotar | through 0.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69874-nanotar-Path-Traversal.md
- https://github.com/unjs/nanotar
- https://www.npmjs.com/package/nanotar
- https://github.com/advisories/GHSA-92fh-27vv-894w
- https://nvd.nist.gov/vuln/detail/CVE-2025-69874