PT-2026-5047 · Node-Tar+2 · Node-Tar+2

Mistersiddd · Publicado 2026-01-27 · Atualizado 2026-06-04 · CVE-2026-24842

Positive Technologies (AI Summary) · Pt

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:P/A:N

Nome do Software Vulnerável e Versões Afetadas Versões do node-tar anteriores à 7.5.7

Descrição O software node-tar apresenta uma falha na qual a verificação de segurança para entradas de hardlink utiliza uma lógica de resolução de caminho diferente do processo real de criação de hardlink. Essa discrepância permite que um arquivo TAR malicioso contorne as proteções contra path traversal e crie hardlinks para arquivos fora do diretório de extração pretendido.

Recomendações Atualize para a versão 7.5.7 ou superior.

Exploit

Correção

Path traversal

Link Following

Enumeração de Fraquezas

CWE-22

CWE-59

Identificadores relacionados

ALSA-2026:18480

ALSA-2026:18868

BDU:2026-00891

CLEANSTART-2026-AD27625

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-NB51079

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CLEANSTART-2026-TZ34913

CVE-2026-24842

GHSA-34X7-HFP2-RC4V

OPENSUSE-SU-2026:10410-1

RHSA-2026:18868

Produtos afetados

Confluence

Rocky Linux

Node-Tar

Referências · 218

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24842.json · Exploit
• https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v · Aviso do Fabricante
• https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46 · Correção
• https://github.com/isaacs/node-tar · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SW34937.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CE10526.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DV49099.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ34913.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NB51079.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OW14933.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33349 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-9ppj-qmqm-q256 · Nota
• https://osv.dev/vulnerability/CVE-2026-1525 · Nota