VDB
DEBIAN-CVE-2026-26960
DEBIAN-CVE-2026-26960
PUBLISHED
CVSS 7.099999904632568 HIGH
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
Risk Scores
CVSS v3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | node-tar | 0, 6.2.1, 6.2.1+ds1 |
| Debian:11 | node-tar | 0, 6.0.5+ds1+~cs11.3.9-1+deb11u1, 6.0.5+ds1+~cs11.3.9-1+deb11u2 |
| Debian:13 | node-tar | 6.2.1+ds1+~cs6.1.13-1, 6.2.1, 0 |
| Debian:14 | node-tar | 6.2.1+ds1+~cs6.1.13-3, 6.2.1+ds1+~cs6.1.13-2, 6.2.1+ds1+~cs6.1.13-1 |
Timeline
- Feb 20, 2026 CVE Published
- May 16, 2026 CVE Updated