- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 21
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 5 excluded.
Web 1
- https://github.com/isaacs/node-tar
Products and areas 10
- Archive creation and the pack path, including what happens when the files being archived are attacker-influenced
- GNU tar extensions, long name and long link entries, and sparse file handling
- No security policy is published, so no scope is declared and nothing is carved out. The channel that exists is GitHub private vulnerability reporting on the repository, and the maintainers accept and publish advisories through it continuously. Treat the whole library as in scope
- Path handling on Windows specifically: drive-relative paths, UNC prefixes, reserved names and the case and separator semantics that differ from POSIX
- PAX extended header records end to end, including record length parsing, keyword handling and the numeric and path overrides they apply
- Symlink and hardlink entry handling, including the link target resolution and the checks meant to keep a link inside the extraction root
- Tar header parsing: the ustar header fields, numeric encodings, the octal and base-256 forms, checksums and the NUL termination rules
- The extraction path in full: entry filtering, path resolution, the strip-components handling and every filesystem write it performs
- The listing and replace APIs, plus directory creation, permission setting and mtime handling during extraction
- The streaming parse and unpack pipeline, its backpressure and its behaviour when a stream ends mid-entry
Out of scope (5)
- Callers that extract into a directory they do not control, or that disable the library's own path protections and then get what they asked for
- Compression-ratio denial of service inherent to gzip or tar rather than to this implementation
- Findings against versions where the fix has already shipped, given how frequently this project releases
- npm's own install logic and the npm registry, which belong to GitHub's paid programme rather than to this library
- Other tar implementations. GNU tar, libarchive and the rest are separate targets with separate reporting
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Use GitHub private vulnerability reporting on isaacs/node-tar . It is enabled and actively used, and it is the only private channel
-
Attach the tarball. On this target the malicious archive is the report, and the published advisories are precise about the exact header bytes involved
-
State the platform. Several recent findings turned on Windows path semantics, including drive-relative link targets that are harmless on POSIX
-
Say whether extraction ran with the default options or with a setting the caller had to choose. The default path is what npm uses and is worth far more
-
Name the version range you tested. This library ships fixes frequently and a finding against a superseded release will close
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 21 CVEs, 13 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 13 Last 12 months 21 Lifetime Link escape and path traversal 40 % Uncontrolled recursion and hangs 30 % PAX header parsing 20 % Type confusion 10 % Latest advisories Loading the feed Overview node-tar is the tar extractor npm itself uses, which puts it on essentially every JavaScript developer machine and CI runner at roughly 100 million downloads a week. Its whole job is to take bytes from a registry tarball and write files to disk. GHSA-83g3-92jg-28cx is the reference point: a hardlink target escape producing arbitrary file read and write during an ordinary install. Thirteen advisories landed in the past twelve months alone. The maintainers publish detailed advisories with credit and no reward, so sorona.xyz pays you directly on qualified, reproduced findings. In scope No security policy is published, so no scope is declared and nothing is carved out. The channel that exists is GitHub private vulnerability reporting on the repository, and the maintainers accept and publish advisories through it continuously. Treat the whole library as in scope The extraction path in full: entry filtering, path resolution, the strip-components handling and every filesystem write it performs Symlink and hardlink entry handling, including the link target resolution and the checks meant to keep a link inside the extraction root Tar header parsing: the ustar header fields, numeric encodings, the octal and base-256 forms, checksums and the NUL termination rules PAX extended header records end to end, including record length parsing, keyword handling and the numeric and path overrides they apply GNU tar extensions, long name and long link entries, and sparse file handling The streaming parse and unpack pipeline, its backpressure and its behaviour when a stream ends mid-entry Archive creation and the pack path, including what happens when the files being archived are attacker-influenced The listing and replace APIs, plus directory creation, permission setting and mtime handling during extraction Path handling on Windows specifically: drive-relative paths, UNC prefixes, reserved names and the case and separator semantics that differ from POSIX Out of scope Callers that extract into a directory they do not control, or that disable the library's own path protections and then get what they asked for npm's own install logic and the npm registry, which belong to GitHub's paid programme rather than to this library Other tar implementations. GNU tar, libarchive and the rest are separate targets with separate reporting Compression-ratio denial of service inherent to gzip or tar rather than to this implementation Findings against versions where the fix has already shipped, given how frequently this project releases Most-valued findings Any escape from the extraction root. GHSA-83g3-92jg-28cx reached arbitrary file read and write through a hardlink target, and that class is the highest-value finding here because it triggers during a routine npm install Symlink and hardlink handling that a crafted linkpath defeats, including the drive-relative Windows form that GHSA-9ppj-qmqm-q256 and GHSA-qffp-2rhf-9h96 turned on PAX record parsing defects, the densest part of the 2026 record: type confusion in numeric fields, NUL bytes inside record values, and length prefixes that disagree with the record they describe Non-termination on a small archive. Uncontrolled recursion took GHSA-r292-9mhp-454m and a negative entry size produced an infinite loop in GHSA-8x88-c5mf-7j5w, and both stall a CI runner from a few hundred bytes Anything reachable through npm's own install path, since that is the delivery mechanism to every developer machine and build agent at once Discrepancies between what node-tar extracts and what GNU tar or libarchive extracts from the same archive, which turn a scanner or review step into a bypass Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Use GitHub private vulnerability reporting on isaacs/node-tar . It is enabled and actively used, and it is the only private channel There is no SECURITY.md and no published policy, so there is no stated acknowledgement window and no documented embargo length. Agree the disclosure date in the advisory thread Attach the tarball. On this target the malicious archive is the report, and the published advisories are precise about the exact header bytes involved State the platform. Several recent findings turned on Windows path semantics, including drive-relative link targets that are harmless on POSIX Say whether extraction ran with the default options or with a setting the caller had to choose. The default path is what npm uses and is worth far more Name the version range you tested. This library ships fixes frequently and a finding against a superseded release will close Disclosure Coordinated privately through GitHub vulnerability reporting and published as a detailed GitHub Security Advisory alongside a patched release, with the reporter credited and nothing paid. The 2026 cadence runs hot, with several advisories clearing in a single week in June, so plan for an embargo that ends at the next release rather than at a fixed day count. Downstream propagation is fast, since consumers pick the fix up on the next install. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability