Skip to content
Fencer Vulns
high 7.1

CVE-2026-26960 json

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

published 2026-02-18 8 mo ago modified 2026-09-10 1 mo ago also GHSA-83g3-92jg-28cx , EUVD-2026-8399

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

Patch / fix

  • npm tar 7.5.8
  • isaacs tar 7.5.8
  • node-tar Debian 12 6.1.13+~cs7.0.5-1+deb12u1
  • node-tar Debian 13 6.2.1+~cs7.0.8-1+deb13u1
  • node-tar Debian 14 6.2.1+ds1+~cs6.1.13-8

debian advisories DEBIAN-CVE-2026-26960

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-26960 updated cvss 7.1

node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Fuse 7 io.hawt-project
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/odf-console-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 org.keycloak-keycloak-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1774431617
    fixed: vendor fix RHSA-2026:6428
  • Red Hat OpenShift Dev Spaces 3.27 devspaces 1774448966, devspaces 1774476526
    fixed: vendor fix RHSA-2026:6192
  • Red Hat Trusted Artifact Signer 1.3 rhtas 1773308315
    fixed: vendor fix RHSA-2026:5447
  • Red Hat Cryostat 4 io.cryostat-cryostat
    not affected: component not present
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1773992622, network-observability 1773997913, network-observability 1774431392, network-observability 1774859742, network-observability 1774887582, network-observability 1774962696
    not affected: vulnerable code not present
show 9 more
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9, rhacm2/volsync-rhel9 Red Hat AMQ Broker 7 org.jolokia-jolokia-parent
    not affected: component not present
  • Red Hat build of Apache Camel - HawtIO 4 io.hawt-project
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 6 tar Red Hat Enterprise Linux 7 tar
    not affected: component not present
  • Red Hat Enterprise Linux 8 npm, tar, nodejs, grafana, mozjs60, nodejs-libs, +17 more Red Hat Enterprise Linux 9 gjs, npm, tar, nodejs, polkit, grafana, +12 more Red Hat Enterprise Linux 10 tar, nodejs22, nodejs24, linux-sgx
    not affected: vulnerable code not in execute path
  • Red Hat JBoss Enterprise Application Platform 7 io.hawt-project Red Hat JBoss Enterprise Application Platform 8 io.hawt-project Red Hat JBoss Enterprise Application Platform Expansion Pack io.hawt-project
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-notebook-controller-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9, openshift4/ose-console-rhel9 Red Hat OpenShift Dev Spaces 3.27 devspaces 1773775028, devspaces 1773775064, devspaces 1773775544, devspaces 1774070844, devspaces 1774143680, devspaces 1774155063, +8 more
    not affected: vulnerable code not present
  • Red Hat Process Automation 7 org.uberfire-uberfire-parent
    not affected: component not present
  • Red Hat Trusted Artifact Signer 1.3 rhtas 1773231678, rhtas 1773307592, rhtas 1773307620, rhtas 1773307677, rhtas 1773307765, rhtas 1773308392
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
GitHub 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm tar
<7.5.8
7.5.8

Affected products

  • isaacs node-tar

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.