7.1
High
CVE-2026-26960 node-tar is a full-featured Tar for Node.js
Description
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| node-tar 7.5 | earliest → < 7.5.8 | 7.5.8 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of node-tar
The 14 CVEs of node-tar →
CVE-2026-73566
node-tar is a tar archive manipulation library for Node.js
7.5
High
CVE-2026-59871
node-tar is a tar archive manipulation library for Node.js
5.3
Medium
CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js
8.7
High
CVE-2026-59873
node-tar is a tar archive manipulation library for Node.js
9.2
Critical