Skip to content
Fencer Vulns
high 8.2

CVE-2021-32804 in the critical feed json

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

published 2021-08-03 5 y ago modified 2026-07-08 4 mo ago also GHSA-3jfq-g458-7qm9 , EUVD-2021-1548

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
15.1%
EPSS 15.1% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Patch / fix

  • npm tar 3.2.2, 4.4.14, 5.0.6, 6.1.1
  • tar_project tar 3.2.2, 4.4.14, 5.0.6, 6.1.1
  • siemens sinec_infrastructure_network_services 1.0.1.1
  • node-tar Debian 14, Debian 13, Debian 12 6.1.7+~cs11.3.10-1

debian advisories DEBIAN-CVE-2021-32804

  • npm RHEL 8 1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
  • nodejs RHEL 8 1:14.17.5-1.module+el8.4.0+12247+e2879e58
  • nodejs-nodemon RHEL 8 2.0.3-1.module+el8.3.0+6519+9f98ed83
  • nodejs-full-i18n RHEL 8 1:14.17.5-1.module+el8.4.0+12247+e2879e58
  • nodejs-packaging RHEL 8 23-3.module+el8.3.0+6519+9f98ed83
  • nodejs-packaging RHEL 8, RHEL 8.2 EUS, RHEL 8.1 EUS 17-3.module+el8.1.0+3369+37ae6a45
  • npm RHEL 8 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
  • nodejs RHEL 8 1:12.22.5-1.module+el8.4.0+12242+af52a4c7

red hat advisories RHSA-2021:3666RHSA-2021:3639RHSA-2021:3638RHSA-2021:3623RHSA-2021:3280RHSA-2021:3281

  • nodejs10 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +18 more 10.24.1-150000.1.44.1
  • nodejs14 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +7 more 14.19.0-15.27.1
  • nodejs8 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +6 more 8.17.0-10.19.2
  • nodejs-common SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +16 more 2.0-3.4.1
  • nodejs12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +7 more 12.22.10-4.29.3
  • nodejs10 SLE Module for Web and Scripting 12 10.24.1-1.46.1
  • nodejs14 SLE Module for Web and Scripting 12 14.19.0-6.24.1
  • nodejs8 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 8.17.0-3.54.2

suse advisories SUSE-SU-2022:1717-1SUSE-SU-2022:0715-1SUSE-SU-2022:0704-1SUSE-SU-2022:0657-1SUSE-SU-2022:0570-1SUSE-SU-2022:0569-1

  • nodejs14 openSUSE Leap 15.3 14.19.0-15.27.1
  • nodejs8 openSUSE Leap 15.3 8.17.0-10.19.2
  • nodejs12 openSUSE Leap 15.3 12.22.10-4.29.3

opensuse advisories openSUSE-SU-2022:0715-1openSUSE-SU-2022:0704-1openSUSE-SU-2022:0657-1

  • nodejs-nodemon AlmaLinux 8 2.0.3-1.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.5.0+254+b4526b16
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762
  • npm AlmaLinux 8 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
  • npm AlmaLinux 8 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
  • nodejs AlmaLinux 8 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
  • nodejs AlmaLinux 8 1:12.22.5-1.module_el8.5.0+85+79a7b441
  • nodejs-full-i18n AlmaLinux 8 1:12.22.5-1.module_el8.5.0+85+79a7b441

almalinux advisories ALSA-2021:3666ALSA-2021:3623

  • nodejs Rocky Linux 8 1:14.17.5-1.module+el8.4.0+654+17ff1d38
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.6.0+982+9fdca2d4
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.3.0+100+234774f7
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.4.0+638+5344c6f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
  • nodejs Rocky Linux 8 1:12.22.5-1.module+el8.4.0+647+e905fa21

rocky linux advisories RLSA-2021:3666RLSA-2021:3623

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32804 updated cvss 8.1

nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite

  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/console-rhel8, rhacm2/search-ui-rhel8, rhacm2/console-ui-rhel8, rhacm2/mcm-topology-rhel8, rhacm2/console-header-rhel8, +1 more
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-grafana
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 12.22.5-1.module+el8.4.0+12242+af52a4c7, nodejs 14.17.5-1.module+el8.4.0+12247+e2879e58, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.3-1.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.3-1.module+el8.4.0+11732+c668cc9f, +4 more
    fixed: vendor fix RHSA-2021:3623
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs 12.22.5-1.module+el8.1.0+12238+63fe3aec, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec, nodejs-full-i18n 12.22.5-1.module+el8.1.0+12238+63fe3aec
    fixed: vendor fix RHSA-2021:3639
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs 12.22.5-1.module+el8.2.0+12241+a3db445b, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b, nodejs-full-i18n 12.22.5-1.module+el8.2.0+12241+a3db445b
    fixed: vendor fix RHSA-2021:3638
  • Red Hat OpenShift Data Foundation 4.9 on RHEL-8 odf4/ocs-operator-bundle 4.9.0-5, odf4/odf-operator-bundle 4.9.0-5, odf4/odr-hub-operator-bundle 4.9.0-5, odf4/odr-cluster-operator-bundle 4.9.0-5, odf4/odf-multicluster-operator-bundle 4.9.0-5, odf4/cephcsi-rhel8 4.9-164.57484e3.release_4.9, +9 more
    fixed: vendor fix RHSA-2021:5086
show 2 more
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7
    fixed: vendor fix RHSA-2021:3281
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/application-ui-rhel8 Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Fuse 7 tar-pack Red Hat Quay 3 quay Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7
    +2 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

15.07% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P
GitHub 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm tar
<3.2.2
>=4.0.0, <4.4.14
>=5.0.0, <5.0.6
>=6.0.0, <6.1.1
3.2.2
4.4.14
5.0.6
6.1.1

Affected products

  • npm node-tar

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.