{"id":"CVE-2026-24909","details":"vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.","aliases":["GHSA-gf2c-jwcj-x929"],"modified":"2026-08-12T03:51:31.635575911Z","published":"2026-01-27T22:14:37.716Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-23"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24909.json"},"references":[{"type":"WEB","url":"https://github.com/vltpkg/vltpkg/releases/tag/v1.0.0-rc.10"},{"type":"WEB","url":"https://www.scworld.com/news/six-javascript-zero-day-bugs-lead-to-fears-of-supply-chain-attack"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24909.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24909"},{"type":"FIX","url":"https://github.com/vltpkg/vltpkg/pull/1334"},{"type":"ARTICLE","url":"https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vltpkg/vltpkg","events":[{"introduced":"0"},{"fixed":"bdc8ce26edd932499a037b21e4a7c15cc0223974"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.0.0-rc.10"}]}}],"versions":["v1.0.0-rc.9","v1.0.0-rc.8","v1.0.0-rc.7","v1.0.0-rc.6","v1.0.0-rc.5","v1.0.0-rc.4","v1.0.0-rc.3","v1.0.0-rc.2","v1.0.0-rc.1","v0.0.0-32","v0.0.0-31","v0.0.0-30","v0.0.0-29","v0.0.0-28","v0.0.0-27","v0.0.0-26","v0.0.0-25","v0.0.0-24","v0.0.0-23","v0.0.0-22","v0.0.0-21","v0.0.0-20","v0.0.0-19","v0.0.0-18","v0.0.0-17","v0.0.0-16","v0.0.0-15","v0.0.0-14","v0.0.0-13","v0.0.0-12","v0.0.0-11","v0.0.0-10","v0.0.0-9","v0.0.0-8","v0.0.0-7","v0.0.0-6","v0.0.0-5","v0.0.0-4","v0.0.0-3","v0.0.0-2","v0.0.0-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24909.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}