node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
CVSS Details
- CVSS 4.0 Base Score: 8.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs22-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-libsUpgrade nodejs20-debugsourceUpgrade nodejs22-npmUpgrade nodejs24-full-i18nUpgrade nodejs20-libsUpgrade nodejs24Upgrade nodejs22-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs22-develUpgrade nodejs20Upgrade nodejs20-debuginfoUpgrade nodejs22-docsUpgrade nodejs22-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs20-develUpgrade nodejs24-debuginfoUpgrade nodejs22Upgrade nodejs20-libs-debuginfoUpgrade nodejs24-docsUpgrade nodejs20-docsUpgrade nodejs20-npmUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs22-full-i18nUpgrade v8-11.3-devel | Apr 7, 2026 | Mar 7, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 20, 2026 | May 19, 2026 |
| Debian | — | Upgrade node-tar | Apr 29, 2026 | Apr 29, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub