`tar` is capped at `^6.0.1`, resolving to the deprecated 6.2.1 with 12 unfixed advisories

[eric-lesslie]

Description:

packages/@ionic/cli/package.json declares "tar": "^6.0.1". There have been no 6.x releases since, and the tar maintainer has formally deprecated the entire 6.x line. npm install @ionic/cli prints:

npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain
widely publicized security vulnerabilities, which have been fixed in the current
version. Please update.

All 12 currently-open advisories against 6.2.1 are fixed only in 7.x, so npm audit reports No fix available/

This is not a theoretical exposure. ionic start downloads a remote tarball from STARTER_BASE_URL (https://d2ql0qc7j8u4b2.cloudfront.net) and pipes it straight into tar.extract({ cwd: projectDir }) (src/commands/start.ts:1131); the Cordova integration does the same into a temp dir (src/lib/integrations/cordova/index.ts:68). Several of the unfixed advisories are precisely arbitrary-file-write-on-extract bugs — hardlink and symlink path traversal — which is the exact operation the CLI performs on downloaded archives.

Highest-severity items still affecting 6.2.1:

Advisory	CVE	Severity	Fixed in
GHSA-23hp-3jrh-7fpw	CVE-2026-59873	Critical	7.5.19
GHSA-34x7-hfp2-rc4v	CVE-2026-24842	High	7.5.7
GHSA-83g3-92jg-28cx	CVE-2026-26960	High	7.5.8
GHSA-8qq5-rm4j-mr97	CVE-2026-23745	High	7.5.3
GHSA-qffp-2rhf-9h96	CVE-2026-29786	High	7.5.10
GHSA-9ppj-qmqm-q256	CVE-2026-31802	High	7.5.11
GHSA-r6q2-hw4h-h46w	CVE-2026-23950	High	7.5.4
GHSA-8x88-c5mf-7j5w	CVE-2026-59874	High	7.5.18

Plus four moderate DoS/parser-differential advisories (GHSA-vmf3-w455-68vh, GHSA-w8wr-v893-vjvp, GHSA-gvwx-54wh-qm9j, GHSA-r292-9mhp-454m), all likewise 7.x-only fixes.

The last time this dependency moved was #4300 (Dependabot, tar 5.0.5 → 6.0.1) in January 2020.

Steps to Reproduce:

mkdir tar-repro && cd tar-repro
npm init -y
npm install @ionic/cli@7.2.1
npm ls tar
npm audit

npm ls tar shows tar@6.2.1. npm audit reports the tar advisories as critical with no available fix.

Output:

Install-time deprecation warning:

npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

added 208 packages in 5s

Resolved version:

$ npm ls tar --all
└── tar@6.2.1

npm audit (trimmed to the tar entry):

# npm audit report

tar  <=7.5.20
Severity: critical
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) - https://github.com/advisories/GHSA-vmf3-w455-68vh
node-tar: Process crash via PAX numeric path type confusion - https://github.com/advisories/GHSA-w8wr-v893-vjvp
node-tar: Decompression/parse DoS via unlimited input - https://github.com/advisories/GHSA-23hp-3jrh-7fpw
node-tar: Negative tar entry size causes infinite loop in archive replace - https://github.com/advisories/GHSA-8x88-c5mf-7j5w
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records - https://github.com/advisories/GHSA-gvwx-54wh-qm9j
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection - https://github.com/advisories/GHSA-r292-9mhp-454m
No fix available
node_modules/tar
  @ionic/cli  *
  Depends on vulnerable versions of @ionic/cli-framework-prompts
  Depends on vulnerable versions of tar
  node_modules/@ionic/cli

My ionic info:

Ionic:

   Ionic CLI : 7.2.1

Utility:

   cordova-res : not installed globally
   native-run  : not installed globally

System:

   NodeJS : v22.21.0
   npm    : 10.9.4
   OS     : macOS Unknown

Other Information:

Suggested fix: bump to "tar": "^7.5.22" (or ^7) in packages/@ionic/cli/package.json, with @types/tar dropped since tar 7 ships its own types.

Two things worth flagging for whoever picks this up:

1. The API surface is small. There are only two call sites, both reached through the src/lib/utils/archive.ts re-export shim, and both use the same call: tar.extract({ cwd }) (src/commands/start.ts:1131, src/lib/integrations/cordova/index.ts:68). tar.extract() is still present in 7.x and still returns a writable stream when given no file/entries.

2. engines needs to move too. tar 7 declares "node": ">=18", while @ionic/cli currently declares "node": ">=16.0.0".

Dependabot is configured for daily npm updates (.github/dependabot.yml), but a major-version bump across the ^6 ceiling has not landed.