CVE-2026-29786
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
- Score
- CVSS 3.1 8.6 High
- Status
- Modified - security-advisories@github.com
- Published
- 2026-03-07
- Last modified
- 2026-09-01
- Weaknesses
- CWE-22, CWE-59
Affected products
- Node-tar (Isaacs)
- Tar (Isaacs)
- Acm (Redhat)
- Amq Broker (Redhat)
- Apache Camel Hawtio (Redhat)
- Cryostat (Redhat)
- Enterprise Linux (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Bpms Platform (Redhat)
- Jboss Fuse (Redhat)
- Jbosseapxp (Redhat)
- Logging (Redhat)
- Network Observ Optr (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Red Hat 3scale Amp (Redhat)
- Red Hat Single Sign On (Redhat)
- Trusted Artifact Signer (Redhat)
References
- https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f
- https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96
- https://access.redhat.com/security/cve/CVE-2026-29786
- https://bugzilla.redhat.com/show_bug.cgi?id=2445476
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json
