CVE-2021-37701

CVE-2021-37701 is a high-severity arbitrary file creation/overwrite and arbitrary code execution vulnerability affecting the npm package "tar" (node-tar) in versions prior to 4.4.16, 5.0.8, and 6.1.7, impacting products like Debian, npmjs, Oracle, and Siemens. This flaw allows an attacker to bypass symlink checks during tar file extraction, enabling them to write arbitrary files to arbitrary locations. With a CVSS score of 8.6 (HIGH), the vulnerability has a local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, nor are there public exploits available in Metasploit or ExploitDB, but it has garnered some community discussion and media coverage.