Ignore tar CVEs for about 1 week

We have investigated the uses of the tar dependency and found two use
cases of it in our code base's supply chain:

- electron-builder
- grpc-tools (from their use of @mapbox-node-pre-gyp)

Currently the tar dependency update has not traversed all through the
supply chain in the packages we depend on. electron-builder and their
supply chain was very fast to bump the dependency, but it seems like
@mapbox/node-pre-gyp do not currently have an update available,
currently. A draft PR does exist though.

Link to draft PR for @mapbox/node-pre-gyp tar upgrade:
mapbox/node-pre-gyp#933

When this has been patched we should update immediately.

---

Extended reasoning on ignoring the vulnerable dependency:

The vulnerable tar dependency does not handle arbitrary tar files, as
it is only used by grpc-tools. Unless the specific tar file,
corresponding to the version of grpc-tools we depend on, is compromised
then an attack is not possible.

The tar file is hosted on Github's package repository and for an attack
to be possibe either the grpc-tools team or Github's package
repostitory must be compromised, which currently seems unlikely.

However, even if unlikely we still want to ensure that we can protect
against this attack and if a patch hasn't been made available at the
end of this ignore period we will want to investigate other forms of
mitigation.

Author: tobias-jarvelov

desktop/osv-scanner.toml

@@ -6,3 +6,15 @@ id = "CVE-2024-21528" # GHSA-g974-hxvm-x689
 ignoreUntil = 2026-04-16 # The vulnerability is ignored for 6 months as the affected library is not receiving updates and we can not patch the vulnerability without migrating to another library, which is no minor feat.
 reason = "There is no fix yet and we don't send untrusted input to the first argument of addTranslations"
 
+# tar: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
+[[IgnoredVulns]]
+id = "CVE-2026-23745" # GHSA-8qq5-rm4j-mr97
+ignoreUntil = 2026-02-02
+reason = "The vulnerable tar dependency does not handle arbitrary tar files as it is only used by grpc-tools. Unless the files uploaded by the grpc-tools team to Github's package repository are compromised an attack is not possible."
+
+# tar: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
+[[IgnoredVulns]]
+id = "CVE-2026-23950" # GHSA-r6q2-hw4h-h46w
+ignoreUntil = 2026-02-02
+reason = "The vulnerable tar dependency does not handle arbitrary tar files as it is only used by grpc-tools. Unless the files uploaded by the grpc-tools team to Github's package repository are compromised an attack is not possible."
+