Skip to content
Fencer Vulns
high 7.5

CVE-2018-20834 json

Arbitrary File Overwrite in tar

published 2019-04-30 7 y ago modified 2026-06-17 4 mo ago also GHSA-j44m-qm6p-hp7m , EUVD-2019-0468

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Patch / fix

  • npm tar 2.2.2, 4.4.2
  • isaacs tar 2.2.2, 4.4.2
  • node-tar Debian 14, Debian 13, Debian 12 4.4.4+ds1-2

debian advisories DEBIAN-CVE-2018-20834

  • rh-nodejs8-nodejs RHEL 3 SOFTWARE_COLLECTIONS 8.16.0-1.el7
  • rh-nodejs8-npm RHEL 3 SOFTWARE_COLLECTIONS 6.4.1-8.16.0.1.el7

red hat advisories RHSA-2019:1821

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-20834 updated cvss 8.8

nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-nodejs 8.16.0-1.el7, rh-nodejs8-npm 6.4.1-8.16.0.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nodejs8-nodejs 8.16.0-1.el7, rh-nodejs8-npm 6.4.1-8.16.0.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-nodejs 8.16.0-1.el7, rh-nodejs8-npm 6.4.1-8.16.0.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-nodejs 8.16.0-1.el7, rh-nodejs8-npm 6.4.1-8.16.0.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-nodejs 8.16.0-1.el7, rh-nodejs8-npm 6.4.1-8.16.0.1.el7
    fixed: vendor fix RHSA-2019:1821
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Mobile Application Platform 4 nodejs-tar Red Hat OpenShift Container Platform 3.6 kibana Red Hat OpenShift Container Platform 3.7 kibana Red Hat OpenShift Container Platform 3.9 kibana
    +4 more products
    Red Hat OpenShift Container Platform 3.10 kibana Red Hat OpenShift Container Platform 3.11 kibana Red Hat OpenShift Container Platform 4 kibana Red Hat Software Collections rh-nodejs10-npm, rh-nodejs10-nodejs, rh-nodejs6-nodejs-tar
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.15% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/344595 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm tar
>=3.0.0, <4.4.2
<2.2.2
4.4.2
2.2.2

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.