CVE-2021-32804

CVE-2021-32804 is an arbitrary file creation/overwrite vulnerability in the npm package "tar" (node-tar) affecting versions prior to 6.1.1, 5.0.6, 4.4.14, and 3.3.2, impacting products like Oracle GraalVM and Siemens Sinec Infrastructure Network Services. This flaw stems from insufficient sanitization of absolute paths with repeated path roots, allowing malicious tar files to write to arbitrary locations. With a CVSS score of 8.1 (High), this vulnerability has a network attack vector, low attack complexity, and can lead to high impact on integrity and availability. While there are no known public exploits or active exploitation (not in KEV or Hot List), it has garnered significant community attention with 4 mentions and 3 media articles, indicating awareness of its potential impact.