Which versions of node-tar are affected by CVE-2026-29786?

node-tar versions prior to 7.5.10 allow attackers to overwrite arbitrary files on Windows systems by embedding malicious tar archives, creating risk of application compromise and unauthorized code…. A patch is available.

Is there a public PoC exploit available for CVE-2026-29786?

Yes, a public proof-of-concept exploit is available for CVE-2026-29786. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-29786?

24 hours: Conduct dependency inventory to identify all Node.js applications using node-tar library; prioritize Windows deployments for urgent remediation. 7 days: Upgrade node-tar to version 7.5.10 or later in all affected applications; conduct full testing in staging environments before production deployment. 30 days: Verify patch deployment completion across all Windows production systems; document remediation status for compliance and audit records.

node-tar CVE-2026-29786

Q: What is the CVSS score of CVE-2026-29786?

CVE-2026-29786 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Path Traversal (CWE-22)

2026-03-07 security-advisories@github.com

GHSA-qffp-2rhf-9h96

Path Traversal Node.js Tar Isaacs

8.2

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Requires a victim to extract an attacker-supplied archive locally (AV:L, UI:R, PR:N); impact is file overwrite, so I:H and A:L with no confidentiality loss.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Red Hat

8.6 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:00 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:58 vuln.today

v4 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 04:58 vuln.today

Analysis Updated

Jun 30, 2026 - 04:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 03:24 NVD

6.3 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 11, 2026 - 21:50 vuln.today

Public exploit code

Patch released

Mar 11, 2026 - 21:50 nvd

Patch available

CVE Published

Mar 07, 2026 - 16:15 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

53 npm packages depend on tar (44 direct, 10 indirect)

Ecosystem-wide dependent count for version 7.5.10.

DescriptionCVE.org

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

AnalysisAI

Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intended extraction directory on Windows by embedding a hardlink whose target uses a drive-relative path such as 'C:../target.txt'. The flaw triggers during ordinary tar.x() extraction, so any Node.js application that unpacks untrusted archives on Windows is exposed. Publicly available exploit code exists via the GitHub Security Advisory, though EPSS exploitation probability is very low (0.02%) and it is not listed in CISA KEV.

Technical ContextAI

node-tar (npm package 'tar', maintained by isaacs) is one of the most widely used tar implementations in the Node.js ecosystem and underpins package installation, archive handling, and build tooling. The root cause is CWE-22 (improper limitation of a pathname to a restricted directory / path traversal). node-tar normally sanitizes link and entry paths to keep extraction within the current working directory, but its path-normalization did not account for Windows drive-relative path semantics: a target like 'C:../target.txt' is neither an absolute path nor leading-slash-rooted, yet Windows resolves it relative to the current directory on drive C:, escaping the extraction root. Because the escape rides on a hardlink entry, the extractor follows it and writes through to a location outside cwd. The affected CPE is cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* for all versions prior to 7.5.10.

RemediationAI

Vendor-released patch: upgrade node-tar to 7.5.10 or later (fix commit https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f; advisory https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96). Because 'tar' is frequently a transitive dependency, run 'npm ls tar' to find all paths and use package resolutions/overrides to force the patched version across the dependency tree. Until you can patch, avoid extracting untrusted archives on Windows hosts; if extraction of untrusted input is unavoidable, run it inside a sandboxed or least-privilege process/container so a file overwrite outside cwd has limited reach, and consider stripping/rejecting hardlink entries or post-validating that no extracted path resolves outside the target directory - note these controls add processing overhead and may break legitimate archives that rely on hardlinks. Red Hat advisory: https://access.redhat.com/security/cve/CVE-2026-29786.