AIKIDO-2026-222906

TL;DR

@electron/asar reads, extracts, and packs ASAR archives without fully validating the untrusted header, file offsets, or entry paths. A crafted archive can declare an oversized header or file size that triggers large buffer allocations, supply offsets that read outside the archive bounds, use .. sequences in unpacked-file names to read files outside the .unpacked directory, or contain circular symlinks that cause unbounded recursion. Packing a source directory that contains symlinks with absolute or traversing targets could also place links outside the destination package. The fix adds strict header and offset validation, constrains unpacked reads and extraction to the target directory, and adds circular-symlink detection with a depth limit.