node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs22-develUpgrade nodejs22-debugsourceUpgrade nodejs22-libsUpgrade nodejs20-libsUpgrade nodejs20-debugsourceUpgrade nodejs20-debuginfoUpgrade nodejs20-npmUpgrade nodejs22-docsUpgrade nodejs20-docsUpgrade v8-11.3-develUpgrade nodejs20Upgrade nodejs20-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-debugsourceUpgrade nodejs22-npmUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-develUpgrade nodejs22-debuginfoUpgrade nodejs22-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-develUpgrade nodejs22Upgrade nodejs24-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade nodejs24 | Mar 27, 2026 | Feb 20, 2026 |
| Debian | — | Upgrade node-tar | Apr 29, 2026 | Apr 29, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub