CVE-2026-23745

Aliases:GHSA-8qq5-rm4j-mr97
Advisory lineage Upstream: 0 Downstream: 4
Analyzed
Published: 16 Jan 2026, 22:00
Last modified:21 Jul 2026, 12:05

Vulnerability Summary

Overall Risk (default)
medium
43/100
CVSS Score
8.2 HIGH
v4.0 (cve.org)
EPSS Score
0.33% LOW
0% probability +0.33%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

16 Jan 2026, 22:00
Published
Vulnerability first disclosed
21 Jul 2026, 12:05
Last Modified
Vulnerability information updated

Description

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

CVSS Metrics

  • v4.0•HIGH•Score: 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
  • v4.0•HIGH•Score: 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 8.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS Trends

Current EPSS score: 0.33%• Percentile: 25%

Techniques & Countermeasures

  • CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected Systems

  • isaacs•node-tar

    < 7.5.3

  • isaacs•tar

    < 7.5.3

  • Npm•tar

    < 7.5.3

References (16)