diff --git a/package-lock.json b/package-lock.json
index 37aa850108f69..ad1d38d71d72a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -69,7 +69,7 @@
         "open": "^10.1.2",
         "playwright-core": "1.61.0-alpha-2026-06-04",
         "ssh2": "^1.16.0",
-        "tar": "^7.5.20",
+        "tar": "^7.5.22",
         "tas-client": "0.3.1",
         "undici": "^7.28.0",
         "vscode-oniguruma": "1.7.0",
@@ -18883,9 +18883,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.20",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz",
-      "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
diff --git a/package.json b/package.json
index 1ea5ac2c0832a..987b4712bbd64 100644
--- a/package.json
+++ b/package.json
@@ -155,7 +155,7 @@
     "open": "^10.1.2",
     "playwright-core": "1.61.0-alpha-2026-06-04",
     "ssh2": "^1.16.0",
-    "tar": "^7.5.20",
+    "tar": "^7.5.22",
     "tas-client": "0.3.1",
     "undici": "^7.28.0",
     "vscode-oniguruma": "1.7.0",