CVE-2026-23745

High CVSS: 8.2

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

Vendor

Isaacs

Product

Tar

CWE

CWE-22

Yayın Tarihi

2026-01-16 22:16:26

Güncelleme

2026-02-18 16:20:07

Source Identifier

security-advisories@github.com

KEV Date Added

Kategoriler

CWE-22 Tar HIGH Isaacs 2026

Referanslar

https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97

Benzer Kayıtlar

High

CVE-2026-31802

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink t…

High

CVE-2026-29786

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that p…

High

CVE-2026-26960

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-control…

High

CVE-2026-24842

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink en…

High

CVE-2026-23950

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an…

High

CVE-2025-64756

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, th…