NexaPulse
Subscribe
6.1mediumMedium

CVE-2026-23745

Isaacs Tar

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

Exploitation status

  • Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, someone has to be persuaded to take an action first.

Scoring

CVSS
6.1 (v3.1)
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4
8.2
Weakness
CWE-22
Assigned by
security-advisories@github.com

Dates

Published
2026-01-16
Last modified
2026-08-24
Sources
NVD

Affected products

  • Isaacs Tar- 7.5.3

As listed in the NVD configuration data. Not a statement about your estate.

References