Medium severity · published Jan 16, 2026
CVE-2026-23745
node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
node-tar · isaacs
< 7.5.3 · source: vendor
TA
Tar · Isaacs
before 7.5.3 · source: NVD
CC
Confidential Compute Attestation · Red Hat
All versions, or not specified · source: CISA
LS
Logging Subsystem for Red Hat OpenShift · Red Hat
All versions, or not specified · source: CISA
NO
Network Observability (NETOBSERV) 1.11.0 · Red Hat
All versions, or not specified · source: CISA
OL
OpenShift Lightspeed · Red Hat
All versions, or not specified · source: CISA
OP
OpenShift Pipelines · Red Hat
All versions, or not specified · source: CISA
OS
OpenShift Serverless · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat 3scale API Management Platform 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Connectivity Link 1 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23745
Patch
https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
Exploit
https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:18480
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:18868
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19712
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:2144
More from node-tar
8.2
CVE-2026-24842
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
7.5
CVE-2026-73566
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
7.5
CVE-2026-59871
node-tar: Process crash via PAX numeric path type confusion
7.5
CVE-2026-59874
node-tar: Negative tar entry size causes infinite loop in archive replace
7.5
CVE-2026-59873
node-tar: Decompression/parse DoS via unlimited input