pear/archive_tar

Two contributors made three commits in the last three months, and this version has tests and release notes. The workflow leaves all three actions unpinned, so reproducibility could be improved.

Latest 1.6.1

Packagist

87%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

100

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all three referenced actions are unpinned, which is a minor reproducibility and supply-chain hygiene concern.

Vulnerabilities

Title	Versions	Severity
CVE-2018-1000888 pear/archive_tar is vulnerable to Security Vulnerability in versions 0.0.0 - 1.4.4.	0.0.0 - 1.4.4	High
CVE-2006-0931 pear/archive_tar is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 1.2 - 1.3.2.	1.2 - 1.3.2	Critical
CVE-2021-32610 pear/archive_tar is vulnerable to Improper Link Resolution Before File Access ('Link Following') in versions 0.0.0 - 1.4.14.	0.0.0 - 1.4.14	High
CVE-2020-28948 pear/archive_tar is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 1.4.11.	0.0.0 - 1.4.11	High
CVE-2020-28949 pear/archive_tar is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 1.4.11.	0.0.0 - 1.4.11	High