Security readout for executives and security teams
Plain-English summary
A vulnerable node-tar version could write files outside the intended extraction folder when opening a malicious tar archive. The practical risk is unauthorized file creation or overwrite on systems that extract untrusted archives. This can affect confidentiality and integrity, but the source bundle does not show active exploitation.
Executive priority
Prioritize remediation where archive extraction touches customer uploads, CI artifacts, software packages, or partner-supplied files. Lower priority may be reasonable for internal-only tooling that never processes untrusted tar content, but version cleanup is still recommended.
Technical view
node-tar tried to convert absolute archive paths into relative paths when preservePaths was not enabled, but repeated absolute path roots were not fully stripped. A crafted archive entry could still resolve as absolute and be written outside the target directory. Fixed releases are listed for major versions 3, 4, 5, and 6.
Likely exposure
Exposure is most likely in Node.js applications, build systems, CLIs, or services that use npm tar/node-tar to extract tar archives from users, partners, CI inputs, packages, or other untrusted sources.
Exploitation context
The CVSS vector is local with user interaction required and no privileges required. The bundle marks KEV as false and provides no cited evidence of active exploitation. Successful exploitation requires processing a malicious archive with an affected node-tar version.
Researcher notes
The source bundle has an inconsistency for the 3.x fixed version, listing both 3.3.2 and 3.2.2. Treat the GitHub advisory and package metadata as authoritative during validation. This CVE is related to CVE-2021-32803 but should be tracked separately.
Mitigation direction
- Upgrade node-tar to a fixed release for the deployed major version.
- Inventory direct and transitive npm dependencies that include tar/node-tar.
- Avoid extracting untrusted tar archives until affected versions are remediated.
- If upgrading is delayed, use vendor-described onentry or filter path sanitization.
- Confirm the correct 3.x fixed version against the GitHub advisory due source inconsistency.
Validation and detection
- Check package-lock, npm-shrinkwrap, pnpm-lock, or yarn.lock for tar versions.
- Confirm runtime deployments use 3.2.2, 4.4.14, 5.0.6, 6.1.1, or later as applicable.
- Review code paths that extract user-controlled or external tar archives.
- Verify preservePaths is not enabling unsafe extraction behavior unintentionally.
- Confirm compensating filters reject absolute archive paths if upgrade is delayed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-32804 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N1.85.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.npmjs.com/package/tarCVE reference · x_refsource_MISC
- https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9CVE reference · x_refsource_CONFIRM
- https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4CVE reference · x_refsource_MISC
- https://www.npmjs.com/advisories/1770CVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.