Vulnerability-Lookup

OPENSUSE-SU-2026:20998-1

Vulnerability from csaf_opensuse - Published: 2026-06-22 07:40 - Updated: 2026-09-16 21:40

Summary

Security update for tree-sitter-ruby

Severity

Moderate

Notes

Title of the patch: Security update for tree-sitter-ruby

Description of the patch: This update for tree-sitter-ruby fixes the following issues - CVE-2025-5889: brace-expansion: inefficient regular expression complexity in function expand of file index.js (bsc#1244345). - CVE-2025-59343: tar-fs: tar-fs symlink validation bypass (bsc#1250517). Changes for tree-sitter-ruby: - Use correct tree-sitter dirname instead of tree_sitter (bsc#1267461). - update to 0.23.1: * ci(publish): add attestations and generate parser * build: update bindings * fix: remove unnecessary empty string usage * chore: regenerate * ci: update workflows * fix(swift): include scanner.c - update to 0.23.0: * fix(go): correct test * fix: handle != operator definition * feat: support element references with blocks * fix: do not require newline after block comment =end * fix: parsing of multiple unicode escapes * fix: correct repo url - update to 0.21.0: * feat: rewrite scanner with array header and regenerate * build: update bindings and manifests * fix: reverse precedence queries * fix: escape braces in regex * docs: update badges - switch to download_files service - add neovim links - add license file to package

Patchnames: openSUSE-Leap-16.0-1010

CVE-2025-5889

2.5 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 5 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch	—	Vendor Fix

Threats

Impact low

CVE-2025-59343

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 5 products, the same list as for CVE-2025-5889

Threats

Impact moderate

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1244345	self
https://bugzilla.suse.com/1250517	self
https://bugzilla.suse.com/1267461	self
https://www.suse.com/security/cve/CVE-2025-5889/	self
https://www.suse.com/security/cve/CVE-2025-59343/	self
https://www.suse.com/security/cve/CVE-2025-5889	external
https://bugzilla.suse.com/1244340	external
https://www.suse.com/security/cve/CVE-2025-59343	external
https://bugzilla.suse.com/1250515	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tree-sitter-ruby",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tree-sitter-ruby fixes the following issues\n\n- CVE-2025-5889: brace-expansion: inefficient regular expression complexity in function expand of file index.js\n  (bsc#1244345).\n- CVE-2025-59343: tar-fs: tar-fs symlink validation bypass (bsc#1250517).\n\nChanges for tree-sitter-ruby:\n\n- Use correct tree-sitter dirname instead of tree_sitter\n (bsc#1267461).\n\n- update to 0.23.1:\n\n * ci(publish): add attestations and generate parser\n * build: update bindings\n * fix: remove unnecessary empty string usage\n * chore: regenerate\n * ci: update workflows\n * fix(swift): include scanner.c\n\n- update to 0.23.0:\n\n * fix(go): correct test\n * fix: handle != operator definition\n * feat: support element references with blocks\n * fix: do not require newline after block comment =end\n * fix: parsing of multiple unicode escapes\n * fix: correct repo url\n\n- update to 0.21.0:\n\n * feat: rewrite scanner with array header and regenerate\n * build: update bindings and manifests\n * fix: reverse precedence queries\n * fix: escape braces in regex\n * docs: update badges\n\n- switch to download_files service\n- add neovim links\n- add license file to package\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1010",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20998-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1244345",
        "url": "https://bugzilla.suse.com/1244345"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250517",
        "url": "https://bugzilla.suse.com/1250517"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267461",
        "url": "https://bugzilla.suse.com/1267461"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-5889 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-5889/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-59343 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-59343/"
      }
    ],
    "title": "Security update for tree-sitter-ruby",
    "tracking": {
      "current_release_date": "2026-09-16T21:40:29Z",
      "generator": {
        "date": "2026-06-22T07:40:16Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20998-1",
      "initial_release_date": "2026-06-22T07:40:16Z",
      "revision_history": [
        {
          "date": "2026-06-22T07:40:16Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:37:55Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:40:29Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
                "product": {
                  "name": "tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
                  "product_id": "tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tree-sitter-ruby@0.23.1-160000.3.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch",
                "product": {
                  "name": "tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch",
                  "product_id": "tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tree-sitter-ruby-devel@0.23.1-160000.3.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
                "product": {
                  "name": "tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
                  "product_id": "tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tree-sitter-ruby@0.23.1-160000.3.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tree-sitter-ruby-0.23.1-160000.3.1.s390x",
                "product": {
                  "name": "tree-sitter-ruby-0.23.1-160000.3.1.s390x",
                  "product_id": "tree-sitter-ruby-0.23.1-160000.3.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tree-sitter-ruby@0.23.1-160000.3.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
                "product": {
                  "name": "tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
                  "product_id": "tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tree-sitter-ruby@0.23.1-160000.3.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-ruby-0.23.1-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64"
        },
        "product_reference": "tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-ruby-0.23.1-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le"
        },
        "product_reference": "tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-ruby-0.23.1-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x"
        },
        "product_reference": "tree-sitter-ruby-0.23.1-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-ruby-0.23.1-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64"
        },
        "product_reference": "tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
        },
        "product_reference": "tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-5889",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-5889"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x",
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
          "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-5889",
          "url": "https://www.suse.com/security/cve/CVE-2025-5889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244340 for CVE-2025-5889",
          "url": "https://bugzilla.suse.com/1244340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
            "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
            "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T07:40:16Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-5889"
    },
    {
      "cve": "CVE-2025-59343",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-59343"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x",
          "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
          "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-59343",
          "url": "https://www.suse.com/security/cve/CVE-2025-59343"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250515 for CVE-2025-59343",
          "url": "https://bugzilla.suse.com/1250515"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
            "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.aarch64",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.s390x",
            "openSUSE Leap 16.0:tree-sitter-ruby-0.23.1-160000.3.1.x86_64",
            "openSUSE Leap 16.0:tree-sitter-ruby-devel-0.23.1-160000.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T07:40:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-59343"
    }
  ]
}

CVE-2025-5889 (GCVE-0-2025-5889)

Vulnerability from cvelistv5 – Published: 2025-06-09 18:16 – Updated: 2025-06-11 10:39

Title

juliangruber brace-expansion index.js expand redos

Summary

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

3.1 (Low)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-09 18:45 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity
CWE-400 - Resource Consumption

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/?id.311660	vdb-entrytechnical-description
https://vuldb.com/?ctiid.311660	signaturepermissions-required
https://vuldb.com/?submit.585717	third-party-advisory
https://gist.github.com/mmmsssttt404/37a40ce7d6e5…	exploit
https://github.com/juliangruber/brace-expansion/p…	issue-trackingpatch
https://github.com/juliangruber/brace-expansion/r…	patch

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: 1.1.0 Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Affected: 1.1.4 Affected: 1.1.5 Affected: 1.1.6 Affected: 1.1.7 Affected: 1.1.8 Affected: 1.1.9 Affected: 1.1.10 Affected: 1.1.11 Affected: 2.0.0 Affected: 2.0.1 Affected: 3.0 Affected: 4.0 Unaffected: 1.1.12 Unaffected: 2.0.2 Unaffected: 3.0.1 Unaffected: 4.0.1

Credits

mmmsssttt (VulDB User) tgerbet_enalean (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5889",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-09T18:45:24.910231Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-09T18:45:54.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            },
            {
              "status": "affected",
              "version": "1.1.1"
            },
            {
              "status": "affected",
              "version": "1.1.2"
            },
            {
              "status": "affected",
              "version": "1.1.3"
            },
            {
              "status": "affected",
              "version": "1.1.4"
            },
            {
              "status": "affected",
              "version": "1.1.5"
            },
            {
              "status": "affected",
              "version": "1.1.6"
            },
            {
              "status": "affected",
              "version": "1.1.7"
            },
            {
              "status": "affected",
              "version": "1.1.8"
            },
            {
              "status": "affected",
              "version": "1.1.9"
            },
            {
              "status": "affected",
              "version": "1.1.10"
            },
            {
              "status": "affected",
              "version": "1.1.11"
            },
            {
              "status": "affected",
              "version": "2.0.0"
            },
            {
              "status": "affected",
              "version": "2.0.1"
            },
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "status": "unaffected",
              "version": "1.1.12"
            },
            {
              "status": "unaffected",
              "version": "2.0.2"
            },
            {
              "status": "unaffected",
              "version": "3.0.1"
            },
            {
              "status": "unaffected",
              "version": "4.0.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "mmmsssttt (VulDB User)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "tgerbet_enalean (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component."
        },
        {
          "lang": "de",
          "value": "Eine problematische Schwachstelle wurde in juliangruber brace-expansion bis 1.1.11/2.0.1/3.0.0/4.0.0 ausgemacht. Davon betroffen ist die Funktion expand der Datei index.js. Durch Manipulieren mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als a5b98a4f30d7813266b221435e1eaaf25a1b0ac5 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.1,
            "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-11T10:39:58.114Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-311660 | juliangruber brace-expansion index.js expand redos",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.311660"
        },
        {
          "name": "VDB-311660 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.311660"
        },
        {
          "name": "Submit #585717 | juliangruber @juliangruber/brace-expansion 1.1.11 Inefficient Regular Expression Complexity",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.585717"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-06-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-06-09T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-06-11T12:37:04.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "juliangruber brace-expansion index.js expand redos"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-5889",
    "datePublished": "2025-06-09T18:16:01.889Z",
    "dateReserved": "2025-06-09T06:19:24.886Z",
    "dateUpdated": "2025-06-11T10:39:58.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-59343 (GCVE-0-2025-59343)

Vulnerability from cvelistv5 – Published: 2025-09-24 17:43 – Updated: 2025-11-03 18:13

Title

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

Summary

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-03 14:49 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/mafintosh/tar-fs/security/advi…	x_refsource_CONFIRM
https://github.com/mafintosh/tar-fs/commit/0bd54c…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
mafintosh	tar-fs	Affected: >= 3.0.0, < 3.1.1 Affected: >= 2.0.0, < 2.1.3 Affected: < 1.16.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59343",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-03T14:49:04.310765Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-03T14:49:06.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:13:55.412Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tar-fs",
          "vendor": "mafintosh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.3"
            },
            {
              "status": "affected",
              "version": "\u003c 1.16.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-24T17:43:34.728Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v"
        },
        {
          "name": "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09"
        }
      ],
      "source": {
        "advisory": "GHSA-vj76-c3g6-qr5v",
        "discovery": "UNKNOWN"
      },
      "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59343",
    "datePublished": "2025-09-24T17:43:34.728Z",
    "dateReserved": "2025-09-12T12:36:24.636Z",
    "dateUpdated": "2025-11-03T18:13:55.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:20998-1

CVE-2025-5889 (GCVE-0-2025-5889)

CVE-2025-59343 (GCVE-0-2025-59343)

Tags

Sightings

Nomenclature

Related by attack behaviour