`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680629 advisory.

    `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is     accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`     folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could     allow Arborist to write package dependencies to any arbitrary location on the file system. Note that     symbolic links contained within package artifact contents are filtered out, so another means of creating a     `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace     `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could     supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the     root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making     changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist     2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see     the referenced GHSA-gmw6-94gg-2rc2.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file
    creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file
    whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by
    ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat
    calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with
    the same name as the directory, where the symlink and directory names in the archive entry used
    backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/`
    characters as path separators, however `\` is a valid filename character on posix systems. By first
    creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass
    node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an
    arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary
    file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive
    filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`,
    then on case-insensitive file systems, the creation of the symbolic link would remove the directory from
    the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A
    subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link,
    thinking that the directory had already been created. These issues were addressed in releases 4.4.16,
    5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these
    issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar.
    If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc. (CVE-2021-37701)

  - The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file
    creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file
    whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by
    ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat
    calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with
    names containing unicode values that normalized to the same value. Additionally, on Windows systems, long
    path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A
    specially crafted tar archive could thus include a directory with one form of the path, followed by a
    symbolic link with a different string that resolves to the same file system entity, followed by a file
    using the first form. By first creating a directory, and then replacing that directory with a symlink that
    had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to
    bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into
    an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing
    arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9.
    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are
    still using a v3 release we recommend you update to a more recent version of node-tar. If this is not
    possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p. (CVE-2021-37712)

  - The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file
    creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file
    whose location would be outside of the extraction target directory is not extracted. This is, in part,
    accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that
    contain `..` path portions, and resolving the sanitized paths against the extraction target directory.
    This logic was insufficient on Windows systems when extracting tar files that contained a path that was
    not an absolute path, but specified a drive letter different from the extraction target, such as
    `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`,
    then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current
    working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..`
    portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not
    properly sanitized by the logic that checked for `..` within the normalized and split portions of the
    path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases
    4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for
    these issues. If you are still using a v3 release we recommend you update to a more recent version of
    node-tar. There is no reasonable way to work around this issue without performing the same path
    normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched
    versions of node-tar, rather than attempt to sanitize paths themselves. (CVE-2021-37713)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder
    hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be
    met, and the extraction of package contents will always be performed into the expected folder. This is, in
    part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies
    with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies
    differ only in the case of their name, Arborist's internal data structure saw them as separate items that
    could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file
    systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as
    `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be
    written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in
    their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a
    dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and
    then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any
    existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-
    insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is
    included in npm v7.20.7 and above. (CVE-2021-39134)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder
    hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be
    met, and the extraction of package contents will always be performed into the expected folder. This is
    accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`
    folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could
    allow Arborist to write package dependencies to any arbitrary location on the file system. Note that
    symbolic links contained within package artifact contents are filtered out, so another means of creating a
    `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace
    `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could
    supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the
    root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making
    changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist
    2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see
    the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is     accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`     folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could     allow Arborist to write package dependencies to any arbitrary location on the file system. Note that     symbolic links contained within package artifact contents are filtered out, so another means of creating a     `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace     `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could     supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the     root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making     changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist     2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see     the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder
    hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be
    met, and the extraction of package contents will always be performed into the expected folder. This is
    accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`
    folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could
    allow Arborist to write package dependencies to any arbitrary location on the file system. Note that
    symbolic links contained within package artifact contents are filtered out, so another means of creating a
    `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace
    `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could
    supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the
    root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making
    changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist
    2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see
    the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0101-1 advisory.

    - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names (bsc#1194511).
    - CVE-2021-44532: Fixed certificate Verification Bypass via String Injection (bsc#1194512).
    - CVE-2021-44533: Fixed incorrect handling of certificate subject and issuer fields (bsc#1194513).
    - CVE-2022-21824: Fixed prototype pollution via console.table properties (bsc#1194514).
    - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers(bsc#1191601).
    - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602).
    - CVE-2021-37701: Fixed arbitrary file creation and overwrite vulnerability in nodejs-tar (bsc#1190057).
    - CVE-2021-37712: Fixed arbitrary file creation and overwrite vulnerability in nodejs-tar (bsc#1190056).
    - CVE-2021-37713: Fixed arbitrary file creation/overwrite and arbitrary code execution vulnerability in     nodejs-tar (bsc#1190055).
    - CVE-2021-39134: Fixed symlink following vulnerability in nodejs-arborist (bsc#1190054).
    - CVE-2021-39135: Fixed symlink following vulnerability in nodejs-arborist (bsc#1190053).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1574-1 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - The npm package tar (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     the same name as the directory, where the symlink and directory names in the archive entry used     backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/`     characters as path separators, however `\` is a valid filename character on posix systems. By first     creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass     node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an     arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary     file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive     filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`,     then on case-insensitive file systems, the creation of the symbolic link would remove the directory from     the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A     subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link,     thinking that the directory had already been created. These issues were addressed in releases 4.4.16,     5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these     issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar.
    If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc. (CVE-2021-37701)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     names containing unicode values that normalized to the same value. Additionally, on Windows systems, long     path portions would resolve to the same file system entities as their 8.3 short path counterparts. A     specially crafted tar archive could thus include a directory with one form of the path, followed by a     symbolic link with a different string that resolves to the same file system entity, followed by a file     using the first form. By first creating a directory, and then replacing that directory with a symlink that     had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to     bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into     an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing     arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9.
    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are     still using a v3 release we recommend you update to a more recent version of node-tar. If this is not     possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p. (CVE-2021-37712)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be outside of the extraction target directory is not extracted. This is, in part,     accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that     contain `..` path portions, and resolving the sanitized paths against the extraction target directory.
    This logic was insufficient on Windows systems when extracting tar files that contained a path that was     not an absolute path, but specified a drive letter different from the extraction target, such as     `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`,     then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current     working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..`     portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not     properly sanitized by the logic that checked for `..` within the normalized and split portions of the     path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases     4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for     these issues. If you are still using a v3 release we recommend you update to a more recent version of     node-tar. There is no reasonable way to work around this issue without performing the same path     normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched     versions of node-tar, rather than attempt to sanitize paths themselves. (CVE-2021-37713)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is, in     part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies     with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies     differ only in the case of their name, Arborist's internal data structure saw them as separate items that     could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file     systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as     `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be     written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in     their `package.json` file such as `foo: file:/some/path`. Another package, `pwn-b` could define a     dependency such as `FOO: file:foo.tgz`. On case-insensitive file systems, if `pwn-a` was installed, and     then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any     existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-     insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is     included in npm v7.20.7 and above. (CVE-2021-39134)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is     accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`     folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could     allow Arborist to write package dependencies to any arbitrary location on the file system. Note that     symbolic links contained within package artifact contents are filtered out, so another means of creating a     `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace     `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could     supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the     root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making     changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist     2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see     the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3964-1 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - The npm package tar (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     the same name as the directory, where the symlink and directory names in the archive entry used     backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/`     characters as path separators, however `\` is a valid filename character on posix systems. By first     creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass     node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an     arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary     file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive     filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`,     then on case-insensitive file systems, the creation of the symbolic link would remove the directory from     the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A     subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link,     thinking that the directory had already been created. These issues were addressed in releases 4.4.16,     5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these     issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar.
    If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc. (CVE-2021-37701)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     names containing unicode values that normalized to the same value. Additionally, on Windows systems, long     path portions would resolve to the same file system entities as their 8.3 short path counterparts. A     specially crafted tar archive could thus include a directory with one form of the path, followed by a     symbolic link with a different string that resolves to the same file system entity, followed by a file     using the first form. By first creating a directory, and then replacing that directory with a symlink that     had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to     bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into     an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing     arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9.
    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are     still using a v3 release we recommend you update to a more recent version of node-tar. If this is not     possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p. (CVE-2021-37712)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be outside of the extraction target directory is not extracted. This is, in part,     accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that     contain `..` path portions, and resolving the sanitized paths against the extraction target directory.
    This logic was insufficient on Windows systems when extracting tar files that contained a path that was     not an absolute path, but specified a drive letter different from the extraction target, such as     `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`,     then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current     working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..`     portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not     properly sanitized by the logic that checked for `..` within the normalized and split portions of the     path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases     4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for     these issues. If you are still using a v3 release we recommend you update to a more recent version of     node-tar. There is no reasonable way to work around this issue without performing the same path     normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched     versions of node-tar, rather than attempt to sanitize paths themselves. (CVE-2021-37713)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is, in     part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies     with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies     differ only in the case of their name, Arborist's internal data structure saw them as separate items that     could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file     systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as     `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be     written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in     their `package.json` file such as `foo: file:/some/path`. Another package, `pwn-b` could define a     dependency such as `FOO: file:foo.tgz`. On case-insensitive file systems, if `pwn-a` was installed, and     then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any     existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-     insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is     included in npm v7.20.7 and above. (CVE-2021-39134)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is     accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`     folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could     allow Arborist to write package dependencies to any arbitrary location on the file system. Note that     symbolic links contained within package artifact contents are filtered out, so another means of creating a     `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace     `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could     supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the     root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making     changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist     2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see     the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3964-1 advisory.

    nodejs14 was updated to 14.18.1:

    * deps: update llhttp to 2.1.4

      - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959)
      - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960)

    Changes in 14.18.0:

      * buffer:

        - introduce Blob
        - add base64url encoding option

      * child_process:

        - allow options.cwd receive a URL
        - add timeout to spawn and fork
        - allow promisified exec to be cancel
        - add 'overlapped' stdio flag

      * dns: add 'tries' option to Resolve options
      * fs:

        - allow empty string for temp directory prefix
        - allow no-params fsPromises fileHandle read
        - add support for async iterators to fsPromises.writeFile

      * http2: add support for sensitive headers
      * process: add 'worker' event
      * tls: allow reading data into a static buffer
      * worker: add setEnvironmentData/getEnvironmentData

    Changes in 14.17.6

      * deps: upgrade npm to 6.14.15 which fixes a number of         security issues         (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,          bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,          bsc#1190053, CVE-2021-39135)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3940-1 advisory.

    - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601).
    - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602).
    - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057).
    - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056).
    - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar     (bsc#1190055).
    - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054).
    - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3940-1 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - The npm package tar (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     the same name as the directory, where the symlink and directory names in the archive entry used     backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/`     characters as path separators, however `\` is a valid filename character on posix systems. By first     creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass     node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an     arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary     file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive     filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`,     then on case-insensitive file systems, the creation of the symbolic link would remove the directory from     the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A     subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link,     thinking that the directory had already been created. These issues were addressed in releases 4.4.16,     5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these     issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar.
    If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc. (CVE-2021-37701)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     names containing unicode values that normalized to the same value. Additionally, on Windows systems, long     path portions would resolve to the same file system entities as their 8.3 short path counterparts. A     specially crafted tar archive could thus include a directory with one form of the path, followed by a     symbolic link with a different string that resolves to the same file system entity, followed by a file     using the first form. By first creating a directory, and then replacing that directory with a symlink that     had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to     bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into     an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing     arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9.
    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are     still using a v3 release we recommend you update to a more recent version of node-tar. If this is not     possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p. (CVE-2021-37712)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be outside of the extraction target directory is not extracted. This is, in part,     accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that     contain `..` path portions, and resolving the sanitized paths against the extraction target directory.
    This logic was insufficient on Windows systems when extracting tar files that contained a path that was     not an absolute path, but specified a drive letter different from the extraction target, such as     `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`,     then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current     working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..`     portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not     properly sanitized by the logic that checked for `..` within the normalized and split portions of the     path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases     4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for     these issues. If you are still using a v3 release we recommend you update to a more recent version of     node-tar. There is no reasonable way to work around this issue without performing the same path     normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched     versions of node-tar, rather than attempt to sanitize paths themselves. (CVE-2021-37713)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is, in     part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies     with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies     differ only in the case of their name, Arborist's internal data structure saw them as separate items that     could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file     systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as     `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be     written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in     their `package.json` file such as `foo: file:/some/path`. Another package, `pwn-b` could define a     dependency such as `FOO: file:foo.tgz`. On case-insensitive file systems, if `pwn-a` was installed, and     then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any     existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-     insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is     included in npm v7.20.7 and above. (CVE-2021-39134)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is     accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`     folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could     allow Arborist to write package dependencies to any arbitrary location on the file system. Note that     symbolic links contained within package artifact contents are filtered out, so another means of creating a     `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace     `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could     supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the     root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making     changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist     2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see     the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3886-1 advisory.

    nodejs14 was updated to 14.18.1:

    * deps: update llhttp to 2.1.4

    Security fixes:

    - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959)
    - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960)

    Changes in 14.18.0:

      * buffer:

        - introduce Blob
        - add base64url encoding option

      * child_process:

        - allow options.cwd receive a URL
        - add timeout to spawn and fork
        - allow promisified exec to be cancel
        - add 'overlapped' stdio flag

      * dns: add 'tries' option to Resolve options
      * fs:

        - allow empty string for temp directory prefix
        - allow no-params fsPromises fileHandle read
        - add support for async iterators to fsPromises.writeFile

      * http2: add support for sensitive headers
      * process: add 'worker' event
      * tls: allow reading data into a static buffer
      * worker: add setEnvironmentData/getEnvironmentData

    Changes in 14.17.6:

      * deps: upgrade npm to 6.14.15 which fixes a number of         security issues         (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,          bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,          bsc#1190053, CVE-2021-39135)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 12.22.6 or 14.17.6. It is, therefore, affected by multiple remote code execution vulnerabilities in various components due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Additional impacts of these vulnerabilities include arbitrary file writing and creation. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Node.js reports : npm 6 update - node-tar, arborist, npm cli modules These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist.

ID	Name	Product	Family	Type	Severity
267662	Unity Linux 20.1070e Security Update: nodejs (UTSA-2025-680629)	Nessus	Unity Linux Local Security Checks	Local	high
424218	Alpine: multiple nodejs packages: security update to 14.17.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
424218	Alpine: multiple nodejs packages: security update to 14.17.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
223984	Linux Distros Unpatched Vulnerability : CVE-2021-39135	Nessus	Misc.	Local	high
415214	SCA: security update for @npmcli/arborist (GHSA-gmw6-94gg-2rc2)	Tenable Cloud Security	SCA Checks	Local	high
415214	SCA: security update for @npmcli/arborist (GHSA-gmw6-94gg-2rc2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
405801	Alpine: nodejs: security update to 12.22.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
405801	Alpine: nodejs: security update to 12.22.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
400143	Alpine: multiple nodejs packages: security update to 14.17.5-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400143	Alpine: multiple nodejs packages: security update to 14.17.5-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
156806	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2022:0101-1)	Nessus	SuSE Local Security Checks	Local	high
156130	openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2021:1574-1)	Nessus	SuSE Local Security Checks	Local	high
155934	openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:3964-1)	Nessus	SuSE Local Security Checks	Local	high
155933	SUSE SLES15 Security Update : nodejs14 (SUSE-SU-2021:3964-1)	Nessus	SuSE Local Security Checks	Local	high
155907	SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2021:3940-1)	Nessus	SuSE Local Security Checks	Local	high
155878	openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2021:3940-1)	Nessus	SuSE Local Security Checks	Local	high
155834	SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2021:3886-1)	Nessus	SuSE Local Security Checks	Local	high
154232	Node.js Multiple Vulnerabilities (August 31st 2021 Security Releases)	Nessus	Misc.	Local	high
153819	FreeBSD : Node.js -- August 2021 Security Releases (2) (7062bce0-1b17-11ec-9d9d-0022489ad614)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2021-39135

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high