← All advisories

High severity7.5NVD Advisory· Published Jan 23, 2017· Updated Jun 17, 2026

CVE-2015-8860

CVE-2015-8860

Description

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
tarnpm	< 2.0.0	2.0.0

Affected products

2

Node.js/Node.js
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
Range: <=1.8.4
ghsa-coords
pkg:npm/tar
Range: < 2.0.0

Patches

Vulnerability mechanics

References

6

www.openwall.com/lists/oss-security/2016/04/20/11nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-gfjr-3jmm-4g9vghsaADVISORY
nodesecurity.io/advisories/57nvdMitigationVendor Advisory
nvd.nist.gov/vuln/detail/CVE-2015-8860ghsaADVISORY
github.com/npm/npm/releases/tag/v2.7.5ghsaWEB
www.npmjs.com/advisories/57ghsaWEB

News mentions

0

No linked articles in our index yet.