Medium severity - Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability in tar (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: tar
• Introduced through: [email protected], [email protected] and others

Detailed paths

• Introduced through: [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › @mapbox/[email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › [email protected] › [email protected]

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the lack of folders count validation during the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running the software and even crash the client within few seconds of running it using a path with too many sub-folders inside.

Remediation

Upgrade tar to version 6.2.1 or higher.

References

• GitHub Commit
  
  SNYK-JS-TAR-6476909
  (CVE-2024-28863) [email protected]