CVE-2026-23745
This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
- CVSS 4.0
- 8.2 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- isaacs/tar
- Source
- security-advisories@github.com
References
- https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405ePatch
- https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97Exploit, Patch, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:18480
- https://access.redhat.com/errata/RHSA-2026:18868
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:2144
- https://access.redhat.com/errata/RHSA-2026:2900
- https://access.redhat.com/errata/RHSA-2026:2926
- https://access.redhat.com/errata/RHSA-2026:3782
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:6192
- https://access.redhat.com/security/cve/CVE-2026-23745
- https://bugzilla.redhat.com/show_bug.cgi?id=2430538
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.