diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json
index 9ecf7daf6aa0d5..c92c1f5f4bd338 100644
--- a/packages/backend-defaults/package.json
+++ b/packages/backend-defaults/package.json
@@ -188,7 +188,7 @@
     "rate-limit-redis": "^4.2.0",
     "raw-body": "^2.4.1",
     "selfsigned": "^2.0.0",
-    "tar": "^7.5.6",
+    "tar": "^7.5.8",
     "triple-beam": "^1.4.1",
     "uuid": "^11.0.0",
     "winston": "^3.2.1",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 9a34814ead4a98..3b055fe7ceeea0 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -134,7 +134,7 @@
     "style-loader": "^3.3.1",
     "sucrase": "^3.20.2",
     "swc-loader": "^0.2.3",
-    "tar": "^7.5.6",
+    "tar": "^7.5.8",
     "ts-checker-rspack-plugin": "^1.1.5",
     "ts-morph": "^24.0.0",
     "undici": "^7.2.3",
diff --git a/packages/repo-tools/package.json b/packages/repo-tools/package.json
index 3180dae9a6fd2d..eecb56b6522836 100644
--- a/packages/repo-tools/package.json
+++ b/packages/repo-tools/package.json
@@ -81,7 +81,7 @@
     "minimatch": "^9.0.0",
     "p-limit": "^3.0.2",
     "portfinder": "^1.0.32",
-    "tar": "^7.5.6",
+    "tar": "^7.5.8",
     "ts-morph": "^24.0.0",
     "yaml-diff-patch": "^2.0.0",
     "zod": "^3.25.76"
diff --git a/plugins/scaffolder-node/package.json b/plugins/scaffolder-node/package.json
index 009ee9e509511a..391a35136d2910 100644
--- a/plugins/scaffolder-node/package.json
+++ b/plugins/scaffolder-node/package.json
@@ -69,7 +69,7 @@
     "jsonschema": "^1.5.0",
     "lodash": "^4.17.21",
     "p-limit": "^3.1.0",
-    "tar": "^7.5.6",
+    "tar": "^7.5.8",
     "winston": "^3.2.1",
     "winston-transport": "^4.7.0",
     "zod": "^3.25.76",
diff --git a/yarn.lock b/yarn.lock
index bd4ae969a21c31..5a23fad895b639 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3045,7 +3045,7 @@ __metadata:
     raw-body: "npm:^2.4.1"
     selfsigned: "npm:^2.0.0"
     supertest: "npm:^7.0.0"
-    tar: "npm:^7.5.6"
+    tar: "npm:^7.5.8"
     triple-beam: "npm:^1.4.1"
     uuid: "npm:^11.0.0"
     wait-for-expect: "npm:^3.0.2"
@@ -3411,7 +3411,7 @@ __metadata:
     style-loader: "npm:^3.3.1"
     sucrase: "npm:^3.20.2"
     swc-loader: "npm:^0.2.3"
-    tar: "npm:^7.5.6"
+    tar: "npm:^7.5.8"
     terser-webpack-plugin: "npm:^5.1.3"
     ts-checker-rspack-plugin: "npm:^1.1.5"
     ts-morph: "npm:^24.0.0"
@@ -7065,7 +7065,7 @@ __metadata:
     jsonschema: "npm:^1.5.0"
     lodash: "npm:^4.17.21"
     p-limit: "npm:^3.1.0"
-    tar: "npm:^7.5.6"
+    tar: "npm:^7.5.8"
     winston: "npm:^3.2.1"
     winston-transport: "npm:^4.7.0"
     zod: "npm:^3.25.76"
@@ -7962,7 +7962,7 @@ __metadata:
     minimatch: "npm:^9.0.0"
     p-limit: "npm:^3.0.2"
     portfinder: "npm:^1.0.32"
-    tar: "npm:^7.5.6"
+    tar: "npm:^7.5.8"
     ts-morph: "npm:^24.0.0"
     typedoc: "npm:^0.28.0"
     yaml-diff-patch: "npm:^2.0.0"
@@ -48230,7 +48230,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^7.4.3, tar@npm:^7.5.6":
+"tar@npm:^7.4.3":
   version: 7.5.7
   resolution: "tar@npm:7.5.7"
   dependencies:
@@ -48243,6 +48243,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tar@npm:^7.5.8":
+  version: 7.5.9
+  resolution: "tar@npm:7.5.9"
+  dependencies:
+    "@isaacs/fs-minipass": "npm:^4.0.0"
+    chownr: "npm:^3.0.0"
+    minipass: "npm:^7.1.2"
+    minizlib: "npm:^3.1.0"
+    yallist: "npm:^5.0.0"
+  checksum: 10/1213cdde9c22d6acf8809ba5d2a025212ce3517bc99c4a4c6981b7dc0489bf3b164db9c826c9517680889194c9ba57448c8ff0da35eca9a60bb7689bf0b3897d
+  languageName: node
+  linkType: hard
+
 "tarn@npm:^3.0.2":
   version: 3.0.2
   resolution: "tarn@npm:3.0.2"