Mafintosh
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| tar-fs | 2 | – | Sep 24, 2025 |
| Protocol-buffers-schema parser | 1 | – | Apr 15, 2026 |
Exploited and recent CVEs
- CVE-2026-5758 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution 0.5%
- CVE-2025-59343 tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball 0.6%
- CVE-2025-48387 tar-fs has issue where extract can write outside the specified dir with a specific tarball 0.6%