[GH-ISSUE #258] Security Fix Required: tar-fs Symlink Validation Bypass (CVE-2025-59343) #95

New issue

Closed

opened 2026-03-02 04:11:47 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 04:11:47 +03:00

Owner

Originally created by @alexanderGalushka on GitHub (Dec 3, 2025).
Original GitHub issue: https://github.com/git-ai-project/git-ai/issues/258

Description:
A high-severity vulnerability exists in tar-fs where symlink validation can be bypassed. This may allow an attacker to write files outside the intended extraction directory, leading to possible system compromise depending on extraction paths.

CVE:
CVE-2025-59343

Severity:
HIGH

Installed Version:
2.1.3

Patched Versions:
3.1.1, 2.1.4, 1.16.6

Required Action:
Upgrade to tar-fs >= 2.1.4 (or higher).
Verify any extraction paths to ensure no unsafe writes occur.
Add tests to confirm unsafe symlink extraction is blocked.

Originally created by @alexanderGalushka on GitHub (Dec 3, 2025). Original GitHub issue: https://github.com/git-ai-project/git-ai/issues/258 Description: A high-severity vulnerability exists in tar-fs where symlink validation can be bypassed. This may allow an attacker to write files outside the intended extraction directory, leading to possible system compromise depending on extraction paths. CVE: CVE-2025-59343 Severity: HIGH Installed Version: 2.1.3 Patched Versions: 3.1.1, 2.1.4, 1.16.6 Required Action: Upgrade to tar-fs >= 2.1.4 (or higher). Verify any extraction paths to ensure no unsafe writes occur. Add tests to confirm unsafe symlink extraction is blocked.

kerem closed this issue

2026-03-02 04:11:47 +03:00

kerem commented

2026-03-02 04:11:48 +03:00

Author

Owner

@svarlamov commented on GitHub (Dec 4, 2025):

Thanks for the report, Alexander! Fix came out in the latest release. Please run git-ai upgrade to get it

@svarlamov commented on GitHub (Dec 4, 2025): Thanks for the report, Alexander! Fix came out in the latest release. Please run `git-ai upgrade` to get it

kerem referenced this issue

2026-03-02 04:13:06 +03:00

[PR #98] [MERGED] Bug/fix notes merging behavior #256