Skip to main content

node-tar CVE-2026-23745

HIGH
Path Traversal (CWE-22)
2026-01-16 security-advisories@github.com GHSA-8qq5-rm4j-mr97
Path Traversal Node.js Tar Isaacs
8.2
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.2 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Exploitation occurs during local extraction (AV:L) and needs a victim to unpack the archive (UI:R) but no auth (PR:N); escaping the extraction root changes scope (S:C) with high confidentiality via symlink poisoning and lower integrity via overwrite.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

11
Analysis Updated
Jun 30, 2026 - 06:11 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 06:10 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 06:10 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 06:10 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:23 vuln.today
cvss_changed
Severity Changed
Jun 30, 2026 - 03:23 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:23 NVD
6.1 (MEDIUM) 8.2 (HIGH)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Feb 18, 2026 - 16:20 vuln.today
Public exploit code
Patch released
Feb 18, 2026 - 16:20 nvd
Patch available
CVE Published
Jan 16, 2026 - 22:16 nvd
MEDIUM 6.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 18 npm packages depend on tar (9 direct, 9 indirect)

Ecosystem-wide dependent count for version 7.5.3.

DescriptionCVE.org

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

AnalysisAI

Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive escape its intended extraction root, even with the default-secure preservePaths=false setting. The flaw stems from missing sanitization of the linkpath on hardlink and symbolic-link entries, so absolute symlink targets and hardlinks can redirect writes outside the extraction directory when a victim application unpacks attacker-supplied archives. Publicly available exploit code exists via the GitHub Security Advisory (GHSA-8qq5-rm4j-mr97), though EPSS exploitation probability is very low (0.01%) and it is not listed in CISA KEV; the issue is fixed in 7.5.3.

Technical ContextAI

node-tar (npm package 'tar', maintained by isaacs, CPE cpe:2.3:a:isaacs:tar) is one of the most heavily used tar archive implementations in the Node.js ecosystem, underpinning npm itself and countless build and packaging tools. The vulnerability is a CWE-22 Path Traversal: during extraction, node-tar normally confines all written paths to the extraction root, but it failed to apply that same validation to the linkpath field of Link (hardlink) and SymbolicLink entries. Because hardlinks can point to existing files outside the root and symlinks can carry absolute targets, a crafted archive can cause subsequent entries to be written through the link to arbitrary filesystem locations, defeating the containment that preservePaths=false is supposed to provide.

RemediationAI

Vendor-released patch: 7.5.3 - upgrade node-tar (npm 'tar') to 7.5.3 or later, including transitive copies, and rebuild/redeploy any application that bundles it; the fix is commit 340eb285b6d986e91969a1170d7fe9b0face405e. Platform users should apply the relevant Red Hat errata (e.g. RHSA-2026:2900 and the later RHSA-2026:18480/18868/19712 streams) rather than only the direct npm package. Where an immediate upgrade is not possible, do not extract archives from untrusted sources, and extract only into a disposable, unprivileged sandbox/container with no sensitive files reachable via absolute paths; if your use case never needs links, configure extraction to filter or reject Link and SymbolicLink entries (e.g. a custom filter callback) - the trade-off is that legitimate archives relying on links will fail to extract. Avoid the temptation to set preservePaths=true as a workaround, since that disables containment entirely and makes the situation worse.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

Share

CVE-2026-23745 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy