node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs20-npmUpgrade nodejs22-develUpgrade nodejs20-debugsourceUpgrade nodejs22-npmUpgrade nodejs20-docsUpgrade nodejs22-docsUpgrade nodejs22-libsUpgrade v8-11.3-develUpgrade nodejs20Upgrade nodejs20-libsUpgrade nodejs20-debuginfoUpgrade nodejs24-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs20-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-docsUpgrade nodejs24-npmUpgrade nodejs20-develUpgrade nodejs24-develUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs22-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs22-libs-debuginfoUpgrade nodejs20-libs-debuginfo | Mar 27, 2026 | Feb 20, 2026 |
| Debian | — | Upgrade node-tar | Apr 29, 2026 | Apr 29, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub