Unleash / unleash
86%
master: 91%

LAST BUILD BRANCH: main
DEFAULT BRANCH: master
Repo Added
Files 1135
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 86.188% (-0.01%) from 86.2%
21097719456

push

github

web-flow 
chore(deps): update dependency tar to v7.5.3 [security] (#11240)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [tar](https://redirect.github.com/isaacs/node-tar) | [`7.4.3` →
`7.5.3`](https://renovatebot.com/diffs/npm/tar/7.4.3/7.5.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/tar/7.5.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tar/7.4.3/7.5.3?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2026-23745](https://redirect.github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97)

### Summary

The `node-tar` library (`<= 7.5.2`) fails to sanitize the `linkpath` of
`Link` (hardlink) and `SymbolicLink` entries when `preservePaths` is
false (the default secure behavior). This allows malicious archives to
bypass the extraction root restriction, leading to **Arbitrary File
Overwrite** via hardlinks and **Symlink Poisoning** via absolute symlink
targets.

### Details

The vulnerability exists in `src/unpack.ts` within the `[HARDLINK]` and
`[SYMLINK]` methods.

**1. Hardlink Escape (Arbitrary File Overwrite)**

The extraction logic uses `path.resolve(this.cwd, entry.linkpath)` to
determine the hardlink target. Standard Node.js behavior dictates that
if the second argument (`entry.linkpath`) is an **absolute path**,
`path.resolve` ignores the first argument (`this.cwd`) entirely and
returns the absolute path.

The library fails to validate that this resolved target remains within
the extraction root. A malicious archive can create a hardlink to a
sensitive file on the host (e.g., `/etc/passwd`) and subsequently write
to it, if file permissions allow writing to the target file, bypassing
path-based security measures that may be in place.

**2. Symlink Poisoning**

The extraction logic passes the user-supplied `entry.linkpath` directly
to `... (continued)

1687 of 1897 branches covered (88.93%)

14259 of 16544 relevant lines covered (86.19%)

872.44 hits per line

Relevant lines Covered
16544 RELEVANT LINES 14259 COVERED LINES
872.44 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
21097719456 main chore(deps): update dependency tar to v7.5.3 [security] (#11240) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | ... push web-flow github
86.19
21072182688 main Move ADRs to a new contributing folder (#11238) push web-flow github
86.2
21065826179 main chore: remove unused import in user schema (#11236) Cleaning up an unused import in the user schema. push web-flow github
86.17
21036824613 main chore: no longer default to Regular seat type push nunogois github
86.19
21033173102 main feat: give project owner UPDATE_PROJECT_SEGMENT permissions (#11232) Makes it so that project owners can manage project segments without any additional permissions. It appears to have been an oversight that this wasn't added to the project owner... push web-flow github
86.16
21032022022 main feat: give project owner UPDATE_PROJECT_CONTEXT permissions (#11231) Makes it so that project owners can manage project context fields without any additional permissions. push web-flow github
86.16
21026745633 main chore: add tests for project context field permission (#11226) Adds tests for the new project context field permissions, following up on #11216 and #11214. push web-flow github
86.2
20963130207 main chore: sync users seat type to auth app (#11225) https://linear.app/unleash/issue/2-4098/include-seat-type-property-in-auth-app-user-sync Syncs users seat type to auth app. push web-flow github
86.16
20958587210 main chore: sync read only users total to auth-app (#11220) https://linear.app/unleash/issue/2-4097/sync-read-only-users-total-to-auth-app Adds read only users total to instance stats, so it is synced with auth-app. push web-flow github
86.18
20951372843 main chore: replace update_project permission with update_project_context for project context actions (#11216) Updates the context edit actions in the UI to use the new permission instead of the old update_project. I have verified manually that this ... push web-flow github
86.14
See All Builds (8683)