Regarding impoper tagging of node-tar vulnerability with alpine-tar package when using prisma scan tool

gauravj139 — Mon, 23 Feb 2026 08:59:42 GMT

Below are docker file instruction

FROM docker.io/library/alpine:latest

RUN apk update && apk add --no-cache tar

With this only tar package is being installed within image. But during scan of same image with Prisma security scan tool, it is incorrectly mapping same with "https://nvd.nist.gov/vuln/detail/CVE-2018-20834" having node-tar vulnerability. Also proving fix like below that is again irrelavant.

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2

https://nvd.nist.gov/vuln/detail/CVE-2018-20834

topic Regarding impoper tagging of node-tar vulnerability with alpine-tar package when using prisma scan tool in Cortex Cloud Discussions

Regarding impoper tagging of node-tar vulnerability with alpine-tar package when using prisma scan tool