By vendor

Isaacs vulnerabilities

Known CVEs affecting Isaacs products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-53655MEDIUM 5.5

  Node-tar, a popular JavaScript tar archive library, contains a flaw in how it interprets PAX extended headers—a standard mechanism for adding metadata to tar entries. An attacker can craft a malicious tar file that causes node-tar to misalign its reading position within the archive. This misalignment makes node-tar extract a different set of files than other standard tar tools (GNU tar, libarchive, Python's tarfile module). The practical danger: if your organization uses one library to scan an archive for malware or secrets and a different library to actually extract it, an attacker can hide a malicious file from the scanner while ensuring it gets extracted anyway. This creates a gap in security tooling that could allow sensitive or harmful content to slip through undetected.