Tar and npm Arborist Patches Close Arbitrary Code Execution Vectors

GitHub has disclosed and patched seven vulnerabilities affecting the Node.js packages tar and @npmcli/arborist, several of which can lead to arbitrary code execution during npm package installation. The issues were reported through GitHub's private security bug bounty program between July 21, 2021 and August 13, 2021, with internal review uncovering additional related flaws.

Four of these CVEs — CVE-2021-32804, CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135 — directly impact the npm CLI when processing malicious or untrusted packages. Exploitation can result in arbitrary file overwrites and code execution even when the --ignore-scripts flag is used to suppress lifecycle scripts. The remaining three CVEs affect tar consumers beyond npm, where extraction of untrusted archives is the attack vector.

What breaks the npm security boundary

The npm CLI enforces a boundary that confines package file writes to the appropriate directories within the node_modules hierarchy. These vulnerabilities cross that boundary, allowing a malicious package to overwrite files elsewhere on the system with the privileges of the installing user. Attackers can leverage that by, for example, overwriting executable scripts to achieve code execution.

Beyond the npm CLI, tar ranks among the most downloaded npm packages, with tens of millions of weekly downloads and thousands of dependent projects. Any of those dependents that extract potentially untrusted archives are exposed to the three non-CLI CVEs alongside the two path-handling flaws that also affect npm.

Patched versions and remediation

GitHub recommends updating the npm CLI to version 6.14.15 or 7.21.0 or newer. Users who install npm through Node.js should update to the latest releases of Node 12, 14, or 16 — specifically v12.22.6, v14.17.6, and v16.8.0 or newer, all of which shipped as of August 31, 2021 with patched npm versions.

Projects that depend directly on tar should update to version 4.4.19, 5.0.11, or 6.1.10 or newer. The v3 branch of tar is deprecated; GitHub advises migrating to the latest v6 release, particularly when processing untrusted archives.

In total, GitHub generated 16.7 million Dependabot alerts and delivered 1.8 million notifications to potentially affected users. Registry scans completed on August 5, 2021 found no malicious npm packages actively targeting CVE-2021-32804, and GitHub says it monitored the registry for abuse attempts through remediation. On July 29, 2021, the platform began blocking publication of npm packages containing symbolic links, hard links, or absolute paths, since the npm installer does not support symbolic links and many of these flaws are rooted in cross-platform link handling.

Root causes of each CVE

CVE-2021-32804 affects the npm CLI on all platforms. The issue stems from absolute path extractions in tar, enabling a malicious npm package to overwrite arbitrary files. GitHub's registry scan confirmed no live exploitation of this flaw before the fix. For details, see the advisory GHSA-3jfq-g458-7qm9.

CVE-2021-37713 is a Windows-specific flaw involving drive-relative path extractions. A malicious npm package can write outside its installation root on Windows systems. Advisory: GHSA-5955-9wpr-37jh.

The two @npmcli/arborist vulnerabilities — CVE-2021-39134 and CVE-2021-39135 — both concern symbolic link handling inside the node_modules tree when installing untrusted packages on case-insensitive file systems. Both can result in file overwrites outside the package installation root. Advisories: GHSA-2h3h-q99f-3fhc, GHSA-gmw6-94gg-2rc2.

The remaining three tar issues do not affect the npm CLI because npm intentionally never extracts symlinks from tar archives. They matter for other tar consumers:

  • CVE-2021-32803 involves directory and symlink handling in sequence, allowing archive-based file overwrites. GHSA-r628-mhmh-qjhw.
  • CVE-2021-37701 covers path separator handling in filenames combined with symlink extraction. The patch set also addresses a variant discovered during internal review involving symlinks on case-insensitive file systems and additional path separator confusion. GHSA-9r2w-394v-53qc.
  • CVE-2021-37712 is a directory cache poisoning flaw where Unicode conversions and Windows 8.3 filename semantics can bypass symlink checks. GHSA-qq89-hq3f-393p.

Credits and disclosure

Researchers Robert Chen (@chen-robert) and Philip Papurt (@ginkoid) reported several of these issues through GitHub's private security bug bounty program. GitHub awarded a combined bounty of $14,500 for their reports and thanked the npm project maintainers for cooperating during the coordinated disclosure process.

Patched releases and notification cascade

The first round of fixes shipped on July 26, 2021, with tar 3.2.3, 4.4.15, 5.0.7, and 6.1.2 addressing CVE-2021-32803 and CVE-2021-32804. The npm CLI followed within days: v6.14.14 and v7.20.2, released July 27, included the patched tar to close the CVE-2021-32804 registry attack vector. Node.js 12, 14, and 16 distributions picked up the fixed npm in their releases starting August 3.

Registry-side hardening landed on July 29. The npm registry began rejecting packages containing symlinks, hardlinks, or absolute paths, blocking tarslip packages from publication. That same day, GitHub notified potentially affected and widely used tar dependents plus npm security stakeholders, giving them lead time for coordinated releases. Public advisories for CVE-2021-32803 and CVE-2021-32804 went live on August 3, spreading the word through npm audit and Dependabot notifications.

Follow-on variants and arborist findings

A second bounty report arrived on August 4, assigned CVE-2021-37701. Fixes landed August 9 in tar 4.4.16, 5.0.8, and 6.1.7, with the v3 branch deprecated at the same time. A non-security cleanup followed the next day with versions 4.4.17, 5.0.9, and 6.1.8.

The security work continued to surface related problems. Internal code review uncovered variant vulnerabilities assigned CVE-2021-37712 (August 11) and CVE-2021-37713 (August 12), the latter also affecting the npm CLI. Two additional bounty reports, on August 12 and 13, turned out to collide with those variants already found in the review. The original reporters confirmed on August 12 that CVE-2021-32803 and CVE-2021-32804 were fully remediated in the latest tar releases.

A separate report on August 13 targeted @npmcli/arborist, npm's dependency tree resolver. That issue plus a variant were assigned CVE-2021-39134 and CVE-2021-39135. Fixes for CVE-2021-37712 and CVE-2021-37713 shipped August 18 in tar 4.4.19, 5.0.11, and 6.1.10, with @npmcli/arborist 2.8.2 addressing the arborist CVEs the same day.

Coordinated disclosure for the extended timeline

The npm CLI releases lagged the library fixes while the team coordinated disclosure. v7.21.0 arrived August 19 with patched tar and @npmcli/arborist covering CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135. The v6 line caught up on August 23 with v6.14.15 carrying the same fixes. Potentially affected dependents and npm security stakeholders were notified about these additional issues on August 25.

By August 31, the latest Node.js releases (v12.22.6, v14.17.6, and v16.8.0 or newer) included the patched npm versions. Detailed public advisories for CVE-2021-37701, CVE-2021-37712, CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135 were published the same day, making the fixes visible through both npm audit and GitHub Dependabot notifications.