All the vulnerabilities related to the version 3.0.10 of the package
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
v3.1.0, v2.1.3, v1.16.5 and below
Has been patched in 3.1.1, 2.1.4, and 1.16.6
You can use the ignore option to ignore non files/directories.
ignore (_, header) {
// pass files & directories, ignore e.g. symlinks
return header.type !== 'file' && header.type !== 'directory'
}
Reported by: Mapta / BugBunny_ai