AIKIDO-2026-11010
github.com/intel/oneapi-cli is vulnerable to Path Traversal
81
High Risk
This Affects:
github.com/intel/oneapi-cliTL;DR
The tar extractor in this package previously allowed path traversal during extraction, enabling arbitrary file write outside the intended output directory (e.g., via ../ or absolute paths in tar headers). The fix adds a safe path-joining routine to prevent escapes and rejects unsafe link types (symlinks/hardlinks), with a regression test to ensure traversal cannot write outside the extraction directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and if you use this package’s tar extraction functionality (e.g., ExtractTarGz) and run it on untrusted or attacker-controlled tar archives.
Background info
github.com/intel/oneapi-cli is vulnerable to Path Traversal in versions 0.0.14 - 0.2.12.
How to fix this
Upgrade the github.com/intel/oneapi-cli library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.