Log in Start free

Vulnerability · Published Jan 28, 2026 · Assigned by GitHub_M

CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

High 8.2

In plain English

A high-severity path traversal in node-tar from isaacs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 50.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10sgx-common2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-common2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-libs2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-libs2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-mpa2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-mpa2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pccs2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pccs2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pccs-admin2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pccs-admin2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pckid-tool2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pckid-tool2.26-7.el9ALSA-2026:18868
AlmaLinux:10tdx-qgs2.26-7.el10ALSA-2026:18480
AlmaLinux:9tdx-qgs2.26-7.el9ALSA-2026:18868
Alpine:v3.23pnpm10.33.4-r0ALPINE-CVE-2026-24842
Debian:14node-tar6.2.1+ds1+~cs6.1.13-10DEBIAN-CVE-2026-24842
Rocky Linux:10linux-sgx0:2.26-7.el10RLSA-2026:18480
Rocky Linux:9linux-sgx0:2.26-7.el9RLSA-2026:18868
Ubuntu:22.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-24842
Ubuntu:24.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-24842
Ubuntu:25.10node-tarno fix listedUBUNTU-CVE-2026-24842
Ubuntu:26.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-24842
Ubuntu:26.10node-tarno fix listedUBUNTU-CVE-2026-24842
npmtar7.5.7GHSA-34x7-hfp2-rc4v

Affected products (as reported)

VendorProductVersions
isaacs node-tar < 7.5.7

Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References