Log in Start free

Vulnerability · Published Mar 7, 2026 · Assigned by GitHub_M

CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

High 8.6

In plain English

A high-severity path traversal in node-tar from isaacs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-tar6.1.13+~cs7.0.5-1+deb12u1DEBIAN-CVE-2026-29786
Debian:13node-tar6.2.1+~cs7.0.8-1+deb13u1DEBIAN-CVE-2026-29786
Debian:14node-tar6.2.1+ds1+~cs6.1.13-8DEBIAN-CVE-2026-29786
Ubuntu:22.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-29786
Ubuntu:24.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-29786
Ubuntu:25.10node-tarno fix listedUBUNTU-CVE-2026-29786
Ubuntu:26.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-29786
npmtar7.5.10GHSA-qffp-2rhf-9h96

Affected products (as reported)

VendorProductVersions
isaacs node-tar < 7.5.10

Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References