CVE-2026-29786
Description
A flaw was found in node-tar. A hardlink that points outside the extraction directory can be created by using a drive-relative link target such as C:../target.txt, allowing a file overwrite outside the current working directory during normal tar.x() extraction.
Statement
To exploit this flaw, an attacker must be able to supply a specially crafted archive to be processed by an application using node-tar. Additionally, this vulnerability allows files to be extracted outside the intended directory but it is still limited to the permissions of the node-tar application processing the archive. Due to this reason, this flaw has been rated with an important severity.
This vulnerability does not affect node-tar running on Unix-like systems as it relies on a drive-relative link target to be exploited.
Mitigation
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.6 | 6.3 | 8.6 |
| Attack Vector | Network | Local | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | None | Required | None |
| Scope | Changed | Changed | Changed |
| Confidentiality | None | None | None |
| Integrity Impact | High | High | High |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
node-tar is a library or API designed to handle tar files. Therefore, it may be used in web applications to process user-supplied archives. To reflect this condition, the attack vector metric is set to network and the user interaction metric is set to none.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
