Tag
node-tar Decompression/Parse DoS Vulnerability via Unlimited Input
2 TTPs 1 CVEA Denial of Service (DoS) vulnerability (CVE-2026-59873) exists in the `node-tar` library (npm/tar <= 7.5.18) due to a lack of hard upper bounds on total decompressed data or entry counts, allowing an unauthenticated attacker to craft a small 'Gzip Bomb' archive that exhausts server resources like disk space and CPU, leading to system-wide failure and service outages.
Oras-Go Tar Extraction Vulnerability Allows Current Working Directory Escape (CVE-2026-50163)
5 TTPs 3 IOCsAn attacker can craft a malicious OCI artifact with a tarball layer containing a hardlink entry that uses a relative path for its target, which, when extracted by `oras-go` (<= 2.6.1) or the `oras` CLI, allows the hardlink to resolve against the process's current working directory (CWD) instead of the intended extraction base, leading to arbitrary file read or modification in the victim's CWD via an inode-sharing vulnerability.
MOTW Bypass via CAB, TAR, and 7-Zip Chaining
2 rules 2 TTPs 1 IOCA newly discovered Mark of the Web (MOTW) bypass technique utilizes a chain of CAB, TAR, and 7-Zip archives to circumvent SmartScreen and execute files without security warnings.