CVE-2026-24909: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24909 is a relative path traversal vulnerability in the @vltpkg/tar npm package (part of the vlt JavaScript package manager) that mishandles path sanitization during tar archive extraction. All versions of @vltpkg/tar before 1.0.0-rc.10 are affected. The vulnerability was published on January 27, 2026, with a patch released on January 28, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-23 (Relative Path Traversal): the @vltpkg/tar package's unpack method failed to adequately sanitize file paths embedded in tar archives, allowing path sequences such as .. to resolve to locations outside the intended extraction directory. The fix, merged via PR #1334, replaced the flawed sanitization logic with a realpath-based approach that resolves the absolute base path and verifies each extracted file's resolved path starts within that base, rejecting any traversal attempts outright rather than silently redirecting them (GitHub PR #1334). The attack vector is local (the attacker must supply or influence a malicious tar archive that the victim extracts using vlt), and no privileges are required, though attack complexity is rated High (GitHub Advisory). This vulnerability was part of a broader research disclosure covering multiple zero-days in JavaScript package managers (GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory during package installation or archive unpacking, enabling overwrite of critical system or application files. The primary impact is to integrity (rated High), with no direct confidentiality or availability impact per the CVSS scoring. In a supply chain attack scenario, a malicious npm package could exploit this to plant backdoors, overwrite configuration files, or compromise the developer's environment during installation (GitHub Advisory, GitHub PR #1334).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this specific CVE. The EPSS score is approximately 0.006% (1st percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was disclosed as part of a broader research effort into JavaScript package manager security, described as "PackageGate" — six zero-days in JS package managers (GitHub Advisory).

1. Craft a malicious tar archive: Create a tar archive containing a file with a path-traversal sequence in its filename (e.g., ../../../../etc/cron.d/malicious or ../../../home/user/.bashrc), designed to write outside the intended extraction directory.
2. Distribute as a malicious npm package: Publish or inject the crafted archive as an npm package to a registry accessible to the target, or perform a dependency confusion/supply chain attack targeting a package the victim uses.
3. Trigger extraction via vlt: When the victim runs vlt install or otherwise installs the malicious package using a vulnerable version of vlt (before 1.0.0-rc.10), the @vltpkg/tar unpack method processes the archive without adequate path sanitization.
4. Achieve arbitrary file write: The traversal path resolves outside the package installation directory, writing attacker-controlled content to a target location on the victim's filesystem (e.g., overwriting a startup script, SSH authorized_keys, or application configuration).
5. Achieve persistence or code execution: Depending on the overwritten file and the victim's environment, the attacker may achieve persistent code execution or privilege escalation (GitHub Advisory, GitHub PR #1334).

• File System: Unexpected files created outside the npm package installation directory (e.g., node_modules) during a vlt install operation; modification timestamps on system files (e.g., /etc/, ~/.ssh/, shell rc files) coinciding with package installation events.
• Logs: Package manager logs showing extraction of tar entries with path components containing .. or absolute paths; file system audit logs (e.g., auditd on Linux) recording writes to sensitive directories by the vlt process.
• Process: The vlt process (or its Node.js child processes) writing files to unexpected filesystem locations outside the project or npm cache directories.

Users should upgrade the @vltpkg/tar npm package to version 1.0.0-rc.10 or later, which includes the path sanitization fix (GitHub Release). The fix was merged on December 9, 2025, and the advisory was published January 28, 2026. No configuration-based workaround is available; upgrading is the only remediation. Users who cannot upgrade immediately should avoid installing untrusted packages using affected vlt versions.

The vulnerability was disclosed as part of a broader research effort dubbed "PackageGate," which identified six zero-day vulnerabilities in JavaScript package managers, raising concerns about supply chain attack risks in the JS ecosystem (GitHub Advisory). Coverage appeared in SC World and a Koi.ai blog post, with community discussion noting that npm had not taken action on the broader set of findings. Red Hat also tracked the CVE in their security database (Red Hat).