astro-icon-1.1.5.tgz: 1 vulnerabilities (highest severity is: 7.1) - autoclosed

[mend-for-github-com]

Vulnerable Library - astro-icon-1.1.5.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/package.json

Found in HEAD commit: ec994c1a9bf5ae33c1721ef3568d20d917573751

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (astro-icon version)	Remediation Possible**
CVE-2026-31802	High	7.1	tar-7.5.10.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-31802

Vulnerable Library - tar-7.5.10.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-7.5.10.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/package.json

Dependency Hierarchy:

• astro-icon-1.1.5.tgz (Root Library)
  • tools-4.2.0.tgz
    • ❌ tar-7.5.10.tgz (Vulnerable Library)

Found in HEAD commit: ec994c1a9bf5ae33c1721ef3568d20d917573751

Found in base branch: main

Vulnerability Details

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.

Publish Date: 2026-03-09

URL: CVE-2026-31802

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9ppj-qmqm-q256

Release Date: 2026-03-09

Fix Resolution: tar - 7.5.11

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.