Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
@mem0ai Dependency hardening → Pinned jws to 4.0.1 (CVE-2025-65945) → Pinned tar-fs to ^2.1.4 (CVE-2025-48387, CVE-2025-59343) → Pinned @modelcontextprotocol/sdk to ^1.25.4 (CVE-2025-66414, CVE-2026-0621) → Pinned rollup to ^4.59.0 (CVE-2026-27606)
Post summary
The post announces that several dependencies have been pinned to mitigate known CVEs, indicating a patch/mitigation action rather than an exploit or active threat.
BREAKING: Ubuntu and Mageia patch tar flaws CVE-2024-12905, CVE-2025-48387, CVE-2025-59343, CVE-2026-5704 letting remote attackers overwrite files and inject hidden content via malicious archives. https://threatcluster.io/cluster/multiple-cves-discovered-in-tar-affecting-ubuntu-and-mageia--167df302
Post summary
The message announces that Ubuntu and Mageia have applied patches for several tar flaws (CVE-2024-12905, CVE-2025-48387, CVE-2025-59343, CVE-2026-5704), noting the flaw allows remote attackers to overwrite files and inject hidden content.