PT-2026-3329 · Node-Tar · Node-Tar

Jvr2022 · Published 2026-01-16 · Updated 2026-03-13 · CVE-2026-23745

Positive Technologies · (AI Summary)

CVSS v4.0

8.2

High

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions node-tar versions <= 7.5.2

Description The node-tar library fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false, which is the default secure behavior. This allows malicious archives to bypass extraction root restrictions, potentially leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. The vulnerability exists within the src/unpack.ts file, specifically in the [HARDLINK] and [SYMLINK] methods. A malicious archive can create a hardlink to a sensitive file on the host and potentially overwrite it, if file permissions allow. Additionally, the library allows the creation of symbolic links pointing to sensitive absolute system paths or traversing paths, even with secure extraction defaults.

Recommendations Update to node-tar version 7.5.3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-00589

CLEANSTART-2026-LM41397

CLEANSTART-2026-NY12442

CVE-2026-23745

GHSA-8QQ5-RM4J-MR97

Affected Products

Node-Tar

References · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23745.json · Exploit
• https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97 · Vendor Advisory
• https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e · Patch
• https://osv.dev/vulnerability/CVE-2026-23745 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8qq5-rm4j-mr97 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23745 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-23745 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NY12442 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23745 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23745 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43616 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23745 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26960 · Security Note
• https://bdu.fstec.ru/vul/2026-00589 · Security Note