PT-2026-3329 · Node-Tar+3 · Node-Tar+3

Jvr2022 · Published 2026-01-16 · Updated 2026-05-19 · CVE-2026-23745

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions node-tar versions <= 7.5.2

Description The node-tar library fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false, which is the default secure behavior. This allows malicious archives to bypass extraction root restrictions, potentially leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. The vulnerability exists within the src/unpack.ts file, specifically in the [HARDLINK] and [SYMLINK] methods. A malicious archive can create a hardlink to a sensitive file on the host and potentially overwrite it, if file permissions allow. Additionally, the library allows the creation of symbolic links pointing to sensitive absolute system paths or traversing paths, even with secure extraction defaults.

Recommendations Update to node-tar version 7.5.3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2026:18480

ALSA-2026:18868

BDU:2026-00589

CLEANSTART-2026-AD27625

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-LM41397

CLEANSTART-2026-NB51079

CLEANSTART-2026-NY12442

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CLEANSTART-2026-TZ34913

CVE-2026-23745

GHSA-8QQ5-RM4J-MR97

RHSA-2026:18868

Affected Products

Confluence

Red Os

Rocky Linux

Node-Tar

References · 229

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23745.json · Exploit
• https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97 · Vendor Advisory
• https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25128 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32281 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23745 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1527 · Security Note
• https://ubuntu.com/security/CVE-2026-23745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2229 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-LM41397 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00589 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-33987 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41650 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27143 · Security Note