Skip to content

Fix multiple CVEs by updating node-tar to patched version - #774

Draft
sbouchet wants to merge 4 commits into
che-incubator:mainfrom
sbouchet:CVE-2026-59873
Draft

Fix multiple CVEs by updating node-tar to patched version#774
sbouchet wants to merge 4 commits into
che-incubator:mainfrom
sbouchet:CVE-2026-59873

Conversation

@sbouchet

@sbouchet sbouchet commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

What does this PR do?

This PR fixes CVE-2026-59874 and CVE-2026-59873
node-tar version is updated to 7.5.22

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-11759
https://redhat.atlassian.net/browse/CRW-11762

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

  • the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
  • the corresponding items were added to the CHANGELOG.md file
  • rules for automatic git rebase were added to the .rebase folder

@github-actions

github-actions Bot commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Click here to review and test in web IDE: Contribute

sbouchet and others added 2 commits July 29, 2026 14:55
@sbouchet @claude
fix: update tar to ^7.5.22 (multiple CVEs)
56bd0a6 
Fixes the following node-tar vulnerabilities across all 4 manifests
(code/, code/remote/, code/build/npm/gyp/, code/extensions/copilot/):

- CVE-2026-23745: Arbitrary File Overwrite (fixed in 7.5.3)
- CVE-2026-23950: Race Condition via Unicode (fixed in 7.5.4)
- CVE-2026-24842: Hardlink Arbitrary File Creation (fixed in 7.5.7)
- CVE-2026-26960: Hardlink Target Escape (fixed in 7.5.8)
- CVE-2026-29786: Hardlink Path Traversal (fixed in 7.5.10)
- CVE-2026-31802: Symlink Path Traversal (fixed in 7.5.11)
- CVE-2026-53655: PAX size override (fixed in 7.5.16)
- CVE-2026-59875: Uncaught Exception DoS via NUL byte (fixed in 7.5.17)
- CVE-2026-59874: Negative entry size infinite loop (fixed in 7.5.18)
- CVE-2026-59871: Process crash via PAX numeric path (fixed in 7.5.18)
- CVE-2026-59873: Decompression/parse DoS (fixed in 7.5.19)
- GHSA-r292-9mhp-454m: Uncontrolled recursion DoS (fixed in 7.5.21)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
@sbouchet @claude
chore: add rebase rules for tar update
e7714c1 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
sbouchet and others added 2 commits July 29, 2026 14:57
@sbouchet
use use correct URL
182d9ca 
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
@sbouchet @claude
fix: remove extraneous tar override from copilot
1850816 
The tar override in code/extensions/copilot/package.json is redundant
since tar is already a direct devDependency pinned to ^7.5.22.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

3 similar comments
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

@tolusha

tolusha commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

  • /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
  • /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
  • /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
  • /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
  • /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
  • /che-ai-assistant claude — Run a free-form instruction on this PR
  • /che-ai-assistant help — Show this help message

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rgrunber rgrunber Awaiting requested review from rgrunber rgrunber will be requested when the pull request is marked ready for review rgrunber is a code owner
@azatsarynnyy azatsarynnyy Awaiting requested review from azatsarynnyy azatsarynnyy will be requested when the pull request is marked ready for review azatsarynnyy is a code owner
@RomanNikitenko RomanNikitenko Awaiting requested review from RomanNikitenko RomanNikitenko will be requested when the pull request is marked ready for review RomanNikitenko is a code owner
@vitaliy-guliy vitaliy-guliy Awaiting requested review from vitaliy-guliy vitaliy-guliy will be requested when the pull request is marked ready for review vitaliy-guliy is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sbouchet @tolusha