node-tar CVE-2026-29786
HIGH
GHSA-qffp-2rhf-9h96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft tar with hardlink target 'C:../path'
-
DeliveryDeliver archive to victim app
-
ExploitVictim calls tar.x() on Windows
-
ExecutionDrive-relative path escapes extraction dir
-
PersistOverwrite file outside cwd
-
ImpactTamper or persist via written file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target running node-tar earlier than 7.5.10 on Windows, where drive-relative paths like 'C:../target.txt' are resolved against the current directory, and (2) the victim application extracting an attacker-supplied tar archive via tar.x() (the UI:P / passive user-interaction element). The malicious archive must contain a hardlink entry with a drive-relative link target. Exploitation is limited by being Windows-specific (the documented escape relies on Windows drive-relative semantics, so default Linux/macOS extraction is not known to be affected) and by requiring the attacker to control the archive content being unpacked; no host authentication is needed (PR:N), but local extraction of attacker-supplied input is mandatory (AV:L). |
| Impact | Signals are mixed and point to a real-but-niche issue rather than a mass-exploitation event. The vendor CVSS 4.0 score is 8.2 (High) with AV:L/AC:L/AT:N/PR:N/UI:P and high integrity impact (VI:H/SI:H), reflecting that exploitation requires a victim to extract an attacker-controlled archive locally rather than a remote network attack. EPSS is very low at 0.02% (4th percentile), and the issue is absent from CISA KEV, indicating no evidence of widespread active exploitation. Publicly available exploit code exists (GHSA-qffp-2rhf-9h96), which raises the practical likelihood of opportunistic exploitation. The key limiting factor is platform: the documented vector ('C:../') is Windows-specific drive-relative path handling, so Linux/macOS deployments are likely unaffected even though the CPE does not encode an OS constraint - verify platform scope before deprioritizing. Net: prioritize for Windows-based Node.js services that process untrusted archives; lower urgency elsewhere. |
| Exploit ScenarioDerived | An attacker crafts a tar archive containing a hardlink entry whose target is a drive-relative path like 'C:../../Users/victim/startup/run.bat', then delivers it as a plugin, dependency, upload, or backup file. When a Windows-based Node.js application calls tar.x() to extract it, node-tar resolves the drive-relative target outside the extraction directory and overwrites a sensitive file, enabling persistence or tampering. Public proof-of-concept material accompanies the GitHub advisory, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intended extraction directory on Windows by embedding a hardlink whose target uses a drive-relative path such as 'C:../target.txt'. The flaw triggers during ordinary tar.x() extraction, so any Node.js application that unpacks untrusted archives on Windows is exposed. Publicly available exploit code exists via the GitHub Security Advisory, though EPSS exploitation probability is very low (0.02%) and it is not listed in CISA KEV.
Earlier versions of this analysis (4)
Arbitrary file overwrite outside the extraction directory in node-tar (npm package 'tar') versions <= 7.5.9 lets an attacker who supplies a malicious archive clobber files outside the intended cwd during a normal tar.x() extraction. The flaw stems from a hardlink/symlink whose target uses a Windows drive-relative path such as C:../target.txt; despite the Windows-looking syntax it is reachable on all platforms because node-tar parses paths with win32 logic. Publicly available exploit code exists (GHSA-qffp-2rhf-9h96 PoC), it is fixed in 7.5.10, and EPSS is very low (0.02%) with no CISA KEV listing.
Arbitrary file overwrite outside the extraction directory in node-tar (npm 'tar') before version 7.5.10 lets an attacker-controlled archive plant a hardlink (or symlink) whose drive-relative target like 'C:../target.txt' escapes the chosen cwd during a normal tar.x() extraction. Because the unpack logic checks for '..' segments before stripping the 'C:' drive root, the '..' is reintroduced after the root is removed, resolving the link one or more directories above the extraction root. Publicly available exploit code exists (GHSA-qffp-2rhf-9h96 includes a working PoC), but EPSS is very low (0.02%) and it is not in CISA KEV, so no public exploit identified as actively exploited at time of analysis.
File overwrite outside the extraction directory in node-tar before 7.5.10 allows a malicious archive to create a hardlink whose target uses a Windows drive-relative path such as C:../target.txt, escaping the intended cwd during a normal tar.x() extraction (CWE-22 path traversal). Any Node.js application on Windows that extracts attacker-supplied tar archives is affected; publicly available exploit code exists via the GitHub Security Advisory, though EPSS is very low (0.02%) and there is no public exploit identified as actively used.
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. [CVSS 6.3 MEDIUM]
RemediationAI
Vendor-released patch: upgrade node-tar to 7.5.10 or later (fix commit https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f; advisory https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96). Because 'tar' is frequently a transitive dependency, run 'npm ls tar' to find all paths and use package resolutions/overrides to force the patched version across the dependency tree. Until you can patch, avoid extracting untrusted archives on Windows hosts; if extraction of untrusted input is unavoidable, run it inside a sandboxed or least-privilege process/container so a file overwrite outside cwd has limited reach, and consider stripping/rejecting hardlink entries or post-validating that no extracted path resolves outside the target directory - note these controls add processing overhead and may break legitimate archives that rely on hardlinks. Red Hat advisory: https://access.redhat.com/security/cve/CVE-2026-29786.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
node-tar (npm package 'tar', maintained by isaacs) is one of the most widely used tar implementations in the Node.js ecosystem and underpins package installation, archive handling, and build tooling. The root cause is CWE-22 (improper limitation of a pathname to a restricted directory / path traversal). node-tar normally sanitizes link and entry paths to keep extraction within the current working directory, but its path-normalization did not account for Windows drive-relative path semantics: a target like 'C:../target.txt' is neither an absolute path nor leading-slash-rooted, yet Windows resolves it relative to the current directory on drive C:, escaping the extraction root. Because the escape rides on a hardlink entry, the extractor follows it and writes through to a location outside cwd. The affected CPE is cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* for all versions prior to 7.5.10.
Know when Tar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
Requires a victim to extract an attacker-supplied archive locally (AV:L, UI:R, PR:N); impact is file overwrite, so I:H and A:L with no confidentiality loss.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
9DescriptionCVE.org
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
Executive ViewAI
node-tar versions prior to 7.5.10 allow attackers to overwrite arbitrary files on Windows systems by embedding malicious tar archives, creating risk of application compromise and unauthorized code execution. The vulnerability impacts all Windows-based Node.js applications that extract tar files from untrusted sources. A vendor patch is available and urgent deployment is warranted given the availability of exploit code.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote atta
node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution between validat
Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive
An issue was discovered in the tar crate before 0.4.36 for Rust. Rated high severity (CVSS 7.5), this vulnerability is r
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overw
Path traversal in node-tar versions 7.5.7 and earlier allows local attackers to read and write arbitrary files outside t
node-tar is a Tar for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenti
Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode normalization o
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Over
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite a
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to c
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite
Exploit-DB