PT-2026-24117 · Node-Tar+2 · Node-Tar+2

Jvr2022 · Publicado 2026-01-01 · Atualizado 2026-06-04 · CVE-2026-31802

Positive Technologies (AI Summary) · Pt

CVSS v4.0

8.2

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Nome do Software Vulnerável e Versões Afetadas Versões do node-tar anteriores à 7.5.11

Descrição O software node-tar contém uma falha que permite que seja manipulado para criar um link simbólico que aponta para fora do diretório de extração pretendido. Isso é possível ao utilizar um destino de link simbólico relativo à unidade, como C:../../../target.txt, durante o processo de extração do tar com a função tar.x(). Uma exploração bem-sucedida permite a sobrescrita de arquivos fora do diretório de trabalho atual.

Recomendações Atualize para a versão 7.5.11 do node-tar ou superior.

Exploit

Correção

DoS

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2026-07258

CLEANSTART-2026-AD27625

CLEANSTART-2026-CB77162

CLEANSTART-2026-CE10526

CLEANSTART-2026-DU32240

CLEANSTART-2026-DV49099

CLEANSTART-2026-GS57401

CLEANSTART-2026-NB51079

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CLEANSTART-2026-TZ34913

CVE-2026-31802

GHSA-9PPJ-QMQM-Q256

Produtos afetados

Confluence

Red Os

Node-Tar

Referências · 208

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31802.json · Exploit
• 🔥 https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256 · Exploit
• https://github.com/isaacs/node-tar · Nota
• https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad · Aviso do Fabricante
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SW34937.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CE10526.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DV49099.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DU32240.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ34913.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CB77162.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GS57401.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NB51079.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OW14933.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33349 · Nota de Segurança