I think there may be a problem in pnpm-lock.yaml around line 1.
The node-tar library (<=7.5.2) fails to sanitize the linkpath of Hardlink and Symlink entries when preservePaths is false (default). This allows an attacker to craft a malicious archive that bypasses extraction root restrictions, leading to arbitrary file overwrite via hardlinks and symlink poisoning via absolute symlink targets. The vulnerability is HIGH severity, enabling potential remote code execution or system file corruption.
Something like this might fix it:
Upgrade tar to version 7.5.3 or higher (e.g., update package.json and run pnpm install).
For reference: rule CVE-2026-23745. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
pnpm-lock.yamlaround line 1.The node-tar library (<=7.5.2) fails to sanitize the linkpath of Hardlink and Symlink entries when preservePaths is false (default). This allows an attacker to craft a malicious archive that bypasses extraction root restrictions, leading to arbitrary file overwrite via hardlinks and symlink poisoning via absolute symlink targets. The vulnerability is HIGH severity, enabling potential remote code execution or system file corruption.
Something like this might fix it:
For reference: rule
CVE-2026-23745. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.