HIGH🇬🇧 English

CVE-2026-23745

CVSS 8.2v4.0pub. 2026-01-16upd. 2026-06-30

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

oryginał EN
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Isaacs Tar

    APP
    Isaacs
    < 7.5.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2026-31802HIGH8.2ten sam produkt

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a...

CVE-2026-29786HIGH8.2ten sam produkt

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardl...

CVE-2026-26960HIGH7.1ten sam produkt

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attack...

CVE-2026-24842HIGH8.2ten sam produkt

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for h...

CVE-2026-23950HIGH8.8ten sam produkt

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is ...