@stryke/fs-0.33.70.tgz: 14 vulnerabilities (highest severity is: 8.8) #285

Vulnerable Library - @⁠stryke/fs-0.33.70.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/defu@6.1.4/node_modules/defu/package.json,/package.json

CVE-2026-23950

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the "path-reservations" system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., "ß" and "ss"), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a "PathReservations" system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using "NFD" Unicode normalization (in which "ß" and "ss" are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which "ß" causes an inode collision with "ss")). This enables an attacker to circumvent internal parallelization locks ("PathReservations") using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates "path-reservations.js" to use a normalization form that matches the target filesystem's behavior (e.g., "NFKD"), followed by first "toLocaleLowerCase('en')" and then "toLocaleUpperCase('en')". As a workaround, users who cannot upgrade promptly, and who are programmatically using "node-tar" to extract arbitrary tarball data should filter out all "SymbolicLink" entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.

Publish Date: 2026-01-20

URL: CVE-2026-23950

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-r6q2-hw4h-h46w

Release Date: 2026-01-20

Fix Resolution: tar - 7.5.4

Step up your Open Source Security Game with Mend here

CVE-2026-59873

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

Publish Date: 2026-07-08

URL: CVE-2026-59873

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-23hp-3jrh-7fpw

Release Date: 2026-07-08

Fix Resolution: tar - 7.5.19

Step up your Open Source Security Game with Mend here

CVE-2026-24842

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Publish Date: 2026-01-28

URL: CVE-2026-24842

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-01-28

Fix Resolution: tar - 7.5.7

Step up your Open Source Security Game with Mend here

CVE-2026-85730

Vulnerable Library - smol-toml-1.6.1.tgz

A small, fast, and correct TOML parser/serializer

Library home page: https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • ❌ smol-toml-1.6.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

Publish Date: 2026-09-04

URL: CVE-2026-85730

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-7w5x-hrqm-74c2

Release Date: 2026-09-04

Fix Resolution: smol-toml - 1.7.1

Step up your Open Source Security Game with Mend here

CVE-2026-73566

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

Publish Date: 2026-08-13

URL: CVE-2026-73566

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-r292-9mhp-454m

Release Date: 2026-08-13

Fix Resolution: tar - 7.5.21

Step up your Open Source Security Game with Mend here

CVE-2026-59874

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

Publish Date: 2026-07-08

URL: CVE-2026-59874

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-8x88-c5mf-7j5w

Release Date: 2026-07-08

Fix Resolution: tar - 7.5.18

Step up your Open Source Security Game with Mend here

CVE-2026-35209

Vulnerable Library - defu-6.1.4.tgz

Library home page: https://registry.npmjs.org/defu/-/defu-6.1.4.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/defu@6.1.4/node_modules/defu/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • ❌ defu-6.1.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to "defu()" are vulnerable to prototype pollution. A crafted payload containing a "proto" key can override intended default values in the merged resul. The internal "_defu" function used "Object.assign({}, defaults)" to copy the defaults object. "Object.assign" invokes the "proto" setter, which replaces the resulting object's "[[Prototype]]" with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing "proto" key guard in the "for...in" loop and land in the final result. Version 6.1.5 replaces "Object.assign({}, defaults)" with object spread ("{ ...defaults }"), which uses "[[DefineOwnProperty]]" and does not invoke the "proto" setter.

Publish Date: 2026-04-06

URL: CVE-2026-35209

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-737v-mqg7-c878

Release Date: 2026-04-04

Fix Resolution: defu - 6.1.5

Step up your Open Source Security Game with Mend here

CVE-2026-31802

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.

Publish Date: 2026-03-09

URL: CVE-2026-31802

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-9ppj-qmqm-q256

Release Date: 2026-03-09

Fix Resolution: tar - 7.5.11

Step up your Open Source Security Game with Mend here

CVE-2026-29786

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

Publish Date: 2026-03-07

URL: CVE-2026-29786

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-qffp-2rhf-9h96

Release Date: 2026-03-06

Fix Resolution: tar - 7.5.10

Step up your Open Source Security Game with Mend here

CVE-2026-26960

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

Publish Date: 2026-02-20

URL: CVE-2026-26960

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-83g3-92jg-28cx

Release Date: 2026-02-18

Fix Resolution: tar - 7.5.8

Step up your Open Source Security Game with Mend here

CVE-2026-23745

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

Publish Date: 2026-01-16

URL: CVE-2026-23745

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-8qq5-rm4j-mr97

Release Date: 2026-01-16

Fix Resolution: tar - 7.5.3

Step up your Open Source Security Game with Mend here

CVE-2026-53655

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.

Publish Date: 2026-06-22

URL: CVE-2026-53655

CVSS 3 Score Details (6.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-vmf3-w455-68vh

Release Date: 2026-06-15

Fix Resolution: tar - 7.5.16

Step up your Open Source Security Game with Mend here

CVE-2026-59875

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

Publish Date: 2026-07-08

URL: CVE-2026-59875

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-gvwx-54wh-qm9j

Release Date: 2026-07-08

Fix Resolution: tar - 7.5.17

Step up your Open Source Security Game with Mend here

CVE-2026-59871

Vulnerable Library - tar-6.2.1.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/.pnpm/tar@6.2.1/node_modules/tar/package.json,/package.json

Dependency Hierarchy:

• @⁠stryke/fs-0.33.70.tgz (Root Library)
  • config-tools-1.190.1.tgz
    • giget-1.2.5.tgz
      • ❌ tar-6.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

Publish Date: 2026-07-08

URL: CVE-2026-59871

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-w8wr-v893-vjvp

Release Date: 2026-07-08

Fix Resolution: tar - 7.5.18

Step up your Open Source Security Game with Mend here