{"id":"CVE-2026-23745","title":"node-tar is a Tar for Node.js","summary":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cwe":["CWE-22"],"vendor":"isaacs","product":"tar","affected":["tar < 7.5.3"],"patched":["tar 7.5.3"],"published":"2026-01-16","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","references":[{"url":"https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","label":"security-advisories@github.com"},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:18480","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18868","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2144","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2900","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2926","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3782","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6192","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-23745","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430538","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23745"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","score-dispute"],"epss":0.00376,"epssPercentile":0.31389,"ingestedAt":"2026-06-30T13:26:50.503Z","exploits":{"github":3,"githubRepos":["https://github.com/Jvr2022/CVE-2026-23745","https://github.com/Novem13th/CVE-2026-23745-via-graphql-DEMO","https://github.com/OndrejDrapalik/node-tar-cve-demo"],"checkedAt":"2026-10-27T17:03:00.916Z"},"exploitAvailable":true,"scores":{"nvd":6.1,"vendor":8.2},"slug":"CVE-2026-23745","body":"## Overview\n\nnode-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.\n\n## Affected\n\n- `tar < 7.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tar 7.5.3`\n\n## Vendor advisories\n\n- **RHSA-2026:18480** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:18480)\n- **RHSA-2026:18868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:18868)\n- **RHSA-2026:2900** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.11.0 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2900)\n- **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928)\n- **RHSA-2026:3782** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3782)\n- **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712)\n- **RHSA-2026:6192** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.27 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6192)\n- **RHSA-2026:2926** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.2 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2926)\n- **RHSA-2026:2144** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.3 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2144)\n- **Red Hat VEX** · Important · affected: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, Red Hat 3scale API Management Platform 2, … · no fix planned: Red Hat Enterprise Linux 6, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Pipelines, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5019,"id":"CVE-2026-23745","ts":1788887229006,"field":"exploit_available","old":"false","new":"true"},{"seq":3902,"id":"CVE-2026-23745","ts":1788886360069,"field":"exploit_available","old":"true","new":"false"},{"seq":2724,"id":"CVE-2026-23745","ts":1788883025817,"field":"exploit_available","old":"false","new":"true"},{"seq":1753,"id":"CVE-2026-23745","ts":1788882429840,"field":"exploit_available","old":"true","new":"false"},{"seq":859,"id":"CVE-2026-23745","ts":1788881862857,"field":"exploit_available","old":"false","new":"true"}]}