8.2
High
CVE-2026-29786 node-tar is a full-featured Tar for Node.js
Description
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cryostat 4 | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Network Observability Operator | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published |
Show the 13 other branches Hide the 13 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| node-tar 7.5 | earliest → < 7.5.10 | 7.5.10 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Cryostat 4
The 94 CVEs of Cryostat 4 →
CVE-2026-10832
Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload
5.9
Medium
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
High
CVE-2026-49980
Rclone is a command-line program to sync files and directories to and from different cloud storage providers
9.8
Critical
CVE-2026-54513
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
8.1
High