Fix multiple CVEs by updating node-tar to patched version by sbouchet · Pull Request #774 · che-incubator/che-code

sbouchet · 2026-07-28T21:28:05Z

What does this PR do?

This PR fixes CVE-2026-59874 and CVE-2026-59873
node-tar version is updated to 7.5.22

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-11759
https://redhat.atlassian.net/browse/CRW-11762

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
the corresponding items were added to the CHANGELOG.md file
rules for automatic git rebase were added to the .rebase folder

github-actions · 2026-07-28T21:28:14Z

Click here to review and test in web IDE:

github-actions · 2026-07-29T21:23:22Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

github-actions · 2026-07-29T21:35:27Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

github-actions · 2026-07-29T21:45:53Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

github-actions · 2026-07-29T22:11:27Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

tolusha · 2026-08-04T10:13:30Z

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
/che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
/che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
/che-ai-assistant claude — Run a free-form instruction on this PR
/che-ai-assistant help — Show this help message

Fixes the following node-tar vulnerabilities across all 4 manifests (code/, code/remote/, code/build/npm/gyp/, code/extensions/copilot/): - CVE-2026-23745: Arbitrary File Overwrite (fixed in 7.5.3) - CVE-2026-23950: Race Condition via Unicode (fixed in 7.5.4) - CVE-2026-24842: Hardlink Arbitrary File Creation (fixed in 7.5.7) - CVE-2026-26960: Hardlink Target Escape (fixed in 7.5.8) - CVE-2026-29786: Hardlink Path Traversal (fixed in 7.5.10) - CVE-2026-31802: Symlink Path Traversal (fixed in 7.5.11) - CVE-2026-53655: PAX size override (fixed in 7.5.16) - CVE-2026-59875: Uncaught Exception DoS via NUL byte (fixed in 7.5.17) - CVE-2026-59874: Negative entry size infinite loop (fixed in 7.5.18) - CVE-2026-59871: Process crash via PAX numeric path (fixed in 7.5.18) - CVE-2026-59873: Decompression/parse DoS (fixed in 7.5.19) - GHSA-r292-9mhp-454m: Uncontrolled recursion DoS (fixed in 7.5.21) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

The tar override in code/extensions/copilot/package.json is redundant since tar is already a direct devDependency pinned to ^7.5.22. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Fixes the following node-tar vulnerabilities across all 4 manifests (code/, code/remote/, code/build/npm/gyp/, code/extensions/copilot/) Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

coderabbitai · 2026-08-05T17:41:01Z

Warning

Review limit reached

@sbouchet, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a6391d6-3526-44bb-aa97-4fef942d4e12

📥 Commits

Reviewing files that changed from the base of the PR and between 9d00081 and 477a1ca.

⛔ Files ignored due to path filters (4)

code/build/npm/gyp/package-lock.json is excluded by !**/package-lock.json
code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json
code/remote/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (9)

.rebase/CHANGELOG.md
.rebase/add/code/build/npm/gyp/package.json
.rebase/override/code/extensions/copilot/package.json
.rebase/override/code/package.json
.rebase/override/code/remote/package.json
code/build/npm/gyp/package.json
code/extensions/copilot/package.json
code/package.json
code/remote/package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-05T18:17:29Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

github-actions · 2026-08-05T18:19:32Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-774-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-774-dev-amd64

sbouchet force-pushed the CVE-2026-59873 branch from 1005921 to e7714c1 Compare July 29, 2026 19:56

sbouchet and others added 6 commits August 5, 2026 12:06

chore: add rebase rules for tar update

412c901

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

use use correct URL

d26046c

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

fix: update tar to ^7.5.22 (multiple CVEs)

9e89434

Fixes the following node-tar vulnerabilities across all 4 manifests (code/, code/remote/, code/build/npm/gyp/, code/extensions/copilot/) Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

updated rebase rules

cef6a71

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

sbouchet force-pushed the CVE-2026-59873 branch from 1850816 to cef6a71 Compare August 5, 2026 17:37

sbouchet marked this pull request as ready for review August 5, 2026 17:38

sbouchet requested review from RomanNikitenko, azatsarynnyy, rgrunber and vitaliy-guliy as code owners August 5, 2026 17:38

Merge branch 'main' into CVE-2026-59873

477a1ca

Navigation Menu

Uh oh!

Fix multiple CVEs by updating node-tar to patched version - #774

Fix multiple CVEs by updating node-tar to patched version#774
sbouchet wants to merge 7 commits into
che-incubator:mainfrom
sbouchet:CVE-2026-59873

sbouchet commented Jul 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

tolusha commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

sbouchet commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

What issues does this PR fix?

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

tolusha commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sbouchet commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading