Skip to main content

node-tar CVE-2026-23745

HIGH
Path Traversal (CWE-22)
2026-01-16 security-advisories@github.com GHSA-8qq5-rm4j-mr97
Path Traversal Node.js Tar Isaacs
8.2
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious tar with escaping symlink/hardlink
  2. Delivery
    Deliver as upload, package, or build artifact
  3. Exploit
    Victim extracts with vulnerable node-tar
  4. Execution
    linkpath bypasses extraction root
  5. Impact
    Arbitrary file overwrite or symlink poisoning

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that a vulnerable node-tar (<= 7.5.2) be used to extract an attacker-controlled archive while preservePaths is left at its default value of false; the malicious archive must contain a hardlink entry pointing outside the extraction root and/or a SymbolicLink entry with an absolute (or escaping) linkpath target. The attacker is unauthenticated to the target (PR:N) but cannot act fully autonomously: a victim or victim application must trigger the extraction (UI:A), which limits drive-by mass exploitation. Limiting factors include the local extraction context (AV:L), the dependence on the application actually unpacking untrusted tar input, and the fact that environments that already sandbox extraction or never process untrusted archives are not realistically exposed.
Impact

Signals are mixed and should be weighed against deployment scale. The vendor CVSS 4.0 score of 8.2 reflects AV:L (local), AC:L, PR:N, UI:A (active user interaction required) with high vulnerable-system confidentiality and high subsequent-system confidentiality impact - meaning the attacker does not authenticate, but a victim or victim application must actually extract the malicious archive. EPSS is only 0.01% (1st percentile) and the CVE is NOT in CISA KEV, indicating no observed widespread exploitation; however, public exploit code exists in the GitHub advisory, so weaponization is trivial for a motivated actor. The realistic risk is therefore driven less by raw CVSS and more by exposure: any service or tool that extracts untrusted tar archives using a vulnerable node-tar is genuinely at risk, while the local vector and required interaction make opportunistic mass exploitation unlikely. Note a consistency caveat: the vector is AV:L yet the practical attack often arrives over the network as an uploaded/downloaded archive - the 'local' rating reflects that exploitation occurs during local extraction, not that the attacker needs prior local access.
Exploit ScenarioDerived

An attacker uploads or publishes a malicious tar/tgz archive (for example as an npm package tarball, a CI build artifact, or a user file upload) that contains a symlink entry with an absolute target such as /etc or a hardlink to a sensitive file, followed by an entry that writes through that link. When a vulnerable service or developer extracts the archive with default node-tar settings, the write lands outside the extraction root, overwriting or poisoning the targeted file. Public proof-of-concept exists in the GHSA advisory, and the only barrier is that a victim process must perform the extraction (UI:A).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive escape its intended extraction root, even with the default-secure preservePaths=false setting. The flaw stems from missing sanitization of the linkpath on hardlink and symbolic-link entries, so absolute symlink targets and hardlinks can redirect writes outside the extraction directory when a victim application unpacks attacker-supplied archives. Publicly available exploit code exists via the GitHub Security Advisory (GHSA-8qq5-rm4j-mr97), though EPSS exploitation probability is very low (0.01%) and it is not listed in CISA KEV; the issue is fixed in 7.5.3.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 06:10 cvss changed CVSS 8.2

Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) allow a malicious tar archive to escape the intended extraction directory when a victim extracts it with the default (preservePaths=false) settings. The flaw stems from missing sanitization of the linkpath on hardlink and symbolic-link entries, letting absolute or traversal targets redirect writes outside the extraction root. Publicly available exploit code exists via the GitHub Security Advisory, though EPSS scores exploitation probability at just 0.01% and the issue is not listed in CISA KEV.

v3 Jun 30, 2026 - 06:10 cvss changed CVSS 8.2

Arbitrary file overwrite and symlink poisoning in node-tar (<= 7.5.2) lets a malicious tar archive escape the intended extraction directory because the library does not sanitize the linkpath of hardlink (Link) and SymbolicLink entries even when the default-secure preservePaths=false is set. A victim who extracts a crafted archive can have files written or overwritten anywhere the process has access, via absolute symlink targets and out-of-root hardlinks. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-8qq5-rm4j-mr97); the issue is not in CISA KEV and EPSS is very low (0.01%), so no widespread automated exploitation is currently indicated.

v2 Jun 30, 2026 - 06:10 cvss changed CVSS 8.2

Arbitrary file overwrite and symlink poisoning in node-tar (npm package 'tar', versions <= 7.5.2) lets a crafted archive escape the extraction root because the library fails to sanitize the linkpath of hardlink (Link) and SymbolicLink entries even under the default secure setting preservePaths=false. Any Node.js application that extracts attacker-controlled tar archives can have files written or overwritten outside the intended directory via hardlinks, and sensitive files exposed or clobbered via absolute symlink targets. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-8qq5-rm4j-mr97), though EPSS is negligible (0.01%) and the issue is not in CISA KEV.

v1 Mar 12, 2026 - 21:54 CVSS 6.1

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). [CVSS 6.1 MEDIUM]

RemediationAI

Vendor-released patch: 7.5.3 - upgrade node-tar (npm 'tar') to 7.5.3 or later, including transitive copies, and rebuild/redeploy any application that bundles it; the fix is commit 340eb285b6d986e91969a1170d7fe9b0face405e. Platform users should apply the relevant Red Hat errata (e.g. RHSA-2026:2900 and the later RHSA-2026:18480/18868/19712 streams) rather than only the direct npm package. Where an immediate upgrade is not possible, do not extract archives from untrusted sources, and extract only into a disposable, unprivileged sandbox/container with no sensitive files reachable via absolute paths; if your use case never needs links, configure extraction to filter or reject Link and SymbolicLink entries (e.g. a custom filter callback) - the trade-off is that legitimate archives relying on links will fail to extract. Avoid the temptation to set preservePaths=true as a workaround, since that disables containment entirely and makes the situation worse.

Affected Packages

npm tar fix: 7.5.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

node-tar (npm package 'tar', maintained by isaacs, CPE cpe:2.3:a:isaacs:tar) is one of the most heavily used tar archive implementations in the Node.js ecosystem, underpinning npm itself and countless build and packaging tools. The vulnerability is a CWE-22 Path Traversal: during extraction, node-tar normally confines all written paths to the extraction root, but it failed to apply that same validation to the linkpath field of Link (hardlink) and SymbolicLink entries. Because hardlinks can point to existing files outside the root and symlinks can carry absolute targets, a crafted archive can cause subsequent entries to be written through the link to arbitrary filesystem locations, defeating the containment that preservePaths=false is supposed to provide.

Know when Tar gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.2 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
vuln.today AI 7.1 HIGH

Exploitation occurs during local extraction (AV:L) and needs a victim to unpack the archive (UI:R) but no auth (PR:N); escaping the extraction root changes scope (S:C) with high confidentiality via symlink poisoning and lower integrity via overwrite.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Red Hat 8.2 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
High
Subsequent system: Integrity
Low
Subsequent system: Availability
None

Lifecycle Timeline

9
Analysis Updated
Jun 30, 2026 - 06:11 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 06:10 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 06:10 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 06:10 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:23 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:23 NVD
6.1 (MEDIUM) 8.2 (HIGH)
PoC Detected
Feb 18, 2026 - 16:20 vuln.today
Public exploit code
Patch released
Feb 18, 2026 - 16:20 nvd
Patch available
CVE Published
Jan 16, 2026 - 22:16 nvd
MEDIUM 6.1

DescriptionCVE.org

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

Executive ViewAI

Why It Matters

The node-tar library (versions ≤7.5.2) contains a high-severity file-handling vulnerability (CVE-2026-23745) enabling arbitrary file overwrite through malicious tar archives. Any organization using node-tar to process untrusted archives-including package managers, build pipelines, and deployment tools-faces data integrity and system compromise risks. Publicly available exploit code exists; patching to version 7.5.3 is critical.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Prevalence
Ubiquitous
core npm dependency used by npm itself and countless Node.js tools
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

61
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Affected Products (CPE)CVE.org

cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*

More in Tar

View all
CVE-2016-6321 HIGH POC
7.5 Dec 09

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote atta
CVE-2026-24842 HIGH POC
8.2 Jan 28

node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution between validat
CVE-2026-29786 HIGH POC
8.2 Mar 07

Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intended extract
CVE-2021-38511 HIGH POC
7.5 Aug 10

An issue was discovered in the tar crate before 0.4.36 for Rust. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2021-32804 HIGH
8.1 Aug 03

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overw
CVE-2026-26960 HIGH POC
7.1 Feb 20

Path traversal in node-tar versions 7.5.7 and earlier allows local attackers to read and write arbitrary files outside t
CVE-2024-28863 MEDIUM POC
6.5 Mar 21

node-tar is a Tar for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenti
CVE-2026-23950 MEDIUM POC
5.9 Jan 20

Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode normalization o
CVE-2021-32803 HIGH
8.1 Aug 03

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Over
CVE-2021-37701 HIGH
8.6 Aug 31

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite a
CVE-2018-20482 MEDIUM POC
4.7 Dec 26

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to c
CVE-2021-37713 HIGH
8.6 Aug 31

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e ADVISORY https://access.redhat.com/errata/RHSA-2026:2144 ADVISORY https://access.redhat.com/errata/RHSA-2026:2900 ADVISORY https://access.redhat.com/errata/RHSA-2026:2926 ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:6192 ADVISORY https://vuldb.com/?id.341682 REF https://access.redhat.com/errata/RHSA-2026:18480 REF https://access.redhat.com/errata/RHSA-2026:18868 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/security/cve/CVE-2026-23745 REF https://bugzilla.redhat.com/show_bug.cgi?id=2430538 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy