CVE-2025-48387:
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
Migration status for node-tar-fs (3.0.8+~cs2.0.4-1 to 3.0.9+~cs2.0.4-1): BLOCKED: Needs an approval (either due to a freeze, the source suite or a manual hint)
Issues preventing migration:
∙ ∙ blocked by freeze: is a key package (Follow the freeze policy when applying for an unblock)
![[bug history graph]](https://qa.debian.org/data/bts/graphs/n/node-tar-fs.png){kind=link}