{"id":"ROOT-APP-NPM-CVE-2025-64118","summary":"CVE-2025-64118 in tar - Patched by Root","details":"Root has patched CVE-2025-64118 in the tar package for Root:npm. Multiple fixed versions available.","modified":"2026-09-24T14:15:03.267620322Z","published":"2026-09-24T13:34:51Z","upstream":["CVE-2025-64118"],"database_specific":{"source":"Root","distro":"npm","distro_version":"","severity":"MEDIUM"},"affected":[{"package":{"name":"tar","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-aikido.12"},{"fixed":"7.5.1-aikido.9"},{"fixed":"7.5.1-aikido.10"},{"fixed":"7.5.1-aikido.11"}]}],"database_specific":{"upstream_version":"7.5.1","all_fixed_versions":["7.5.1-aikido.12","7.5.1-aikido.9","7.5.1-aikido.10","7.5.1-aikido.11"],"root_patch_version":"aikido.12","root_patched":true,"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2025-64118.json","total_fixed_versions":4}},{"package":{"name":"@rootio/tar","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-root.io.1"},{"fixed":"7.5.1-root.io.2"},{"fixed":"7.5.1-root.io.3"},{"fixed":"7.5.1-root.io.4"},{"fixed":"7.5.1-root.io.5"},{"fixed":"7.5.1-root.io.6"},{"fixed":"7.5.1-root.io.7"},{"fixed":"7.5.1-root.io.8"},{"fixed":"7.5.1-root.io.12"},{"fixed":"7.5.1-root.io.9"},{"fixed":"7.5.1-root.io.10"},{"fixed":"7.5.1-root.io.11"}]}],"database_specific":{"all_fixed_versions":["7.5.1-root.io.1","7.5.1-root.io.2","7.5.1-root.io.3","7.5.1-root.io.4","7.5.1-root.io.5","7.5.1-root.io.6","7.5.1-root.io.7","7.5.1-root.io.8","7.5.1-root.io.12","7.5.1-root.io.9","7.5.1-root.io.10","7.5.1-root.io.11"],"root_patch_version":"root.io.12","root_patched":true,"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2025-64118.json","total_fixed_versions":12,"upstream_version":"7.5.1"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}