Distillation

Date: Jul 28, 2026

• 🟡 (12:27) PR #1341 file stats: 4 files changed — .lore.md (+79/-7), package.json (+12/-6), packages/spotlight/package.json (+2/-2), pnpm-lock.yaml (+304/-695). headRefOid: 50016108d56cbf3ff88e51b2d11e4273212e7e1b. State: OPEN.
• 🟡 (12:27) PR #1342 file stats: 9 files changed — .lore.md (+79/-7), package.json (+13/-8), packages/spotlight/package.json (+4/-4), packages/spotlight/src/svg.d.ts (+27/NEW), packages/spotlight/vite.config.base.ts (+3/-0), packages/website/astro.config.mjs (+1/-8), packages/website/package.json (+5/-6), pnpm-lock.yaml (+1116/-1529), pnpm-workspace.yaml (+2/-2). headRefOid: 021ac8ec4eb2d1e3c9539fb0d4a39e3f2b7c77eb. State: OPEN.
• 🟡 (12:27) Tool output truncated for tar parser advisory content. Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_fa8b04829001rG20UuGIE6Q7dN
• 🔴 (12:27) GHSA/tar advisory content surfaces node-tar parser bug: parser-differential vulnerability where scanner repeatedly parses same header forever and never reaches append step. Reachable through supported package API when archive file is attacker-controlled. Does not rely on extraction, dependency behavior, or uncaught exception. PoC: node script (poc.mjs) using custom 512-byte header with NUL-injection in path field.
• 🔴 (12:27) Tar parser bug root cause: boundary value consumed by Header/ReadEntry carries embedded NUL through entry.path and entry.linkpath all the way to fs.lstat(). Value half between = and \n is never checked for NUL bytes.
• 🔴 (12:27) Patched cousin path exists at src/parse.ts:375-388 — GNU L/K long-headers case 'NextFileHasLongPath'/'OldGnuLongPath' and 'NextFileHasLongLinkpath' DO strip NUL bytes via this[META].replace(/\0.*/, '') before storing to ex.path and ex.linkpath. This proves the vulnerable code path omits the equivalent strip.
• 🔴 (12:27) Secondary parser-differential validator bypass (CWE-436): for path=visible.txt\0hidden.txt — GNU tar lists visible.txt (truncated at NUL), bsdtar lists visible.txt (truncated at NUL), Python tarfile.list() lists raw visible.txt\0hidden.txt, node-tar tar.t() emits raw NUL-bearing path (no crash), node-tar tar.x() crashes (uncaught throw). Pre-flight validator using GNU/bsdtar sees benign filename; node-tar diverges.
• 🔴 (12:27) Worker process concern: worker may take time to respawn or never respawn if it dies during boot (depending on supervisor behavior).
• 🔴 (12:27) Dependabot alert #297 example — package: tar, GHSA: GHSA-395f-4hp3-45gv, CVE-2026-13311 (shell-quote: Quadratic-complexity DoS in parse() CWE-407), state: open, manifest: pnpm-lock.yaml, scope: runtime, relationship: transitive, fixed_in: <=7.5.16, first_patched_version: 7.5.17. URL: https://github.com/getsentry/spotlight/security/dependabot/297. Created: 2026-07-21T11:58:00Z.
• 🔴 (12:27) shell-quote advisory details (CVE-2026-13311, CWE-407): root cause is prev.concat(arg) reduce in parse() that allocates new array and copies all of prev on every iteration — 1+2+…+N = O(N²) copies for N-token result. A second acc.concat(s) reduce in module.exports wrapper (lines 211-224, reached only when env is a function) has the same shape. Maintainer's own // TODO: replace this whole reduce with a concat already flags the construct.
• 🔴 (12:27) User directive: replace the O(N²) prev.concat(arg) reduce with a concat pattern: return typeof arg === 'undefined' ? prev : prev.concat(arg) — this is the user's preferred fix shape. Maintainer's TODO comment already flags the construct.