Skip to content
OpenAdvisories
High · 8.2 Public exploit CVE-2026-29786 EUVD-2026-10164GHSA-qffp-2rhf-9h96

node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

Published Mar 7, 2026 · Updated Sep 1, 2026 · Assigned by GitHub_M

Vendor: isaacs Product: node-tar Package: jupyter-base-notebook Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: lerna Package: node-gyp Package: node-tar Package: node-tar Package: npm Package: pnpm-stage0 Package: prism Package: pulumi-language-nodejs Package: py3.10-jupyterlab Package: py3.11-jupyterlab Package: py3.12-jupyterlab Package: py3.13-jupyterlab Package: python-tensorboard Package: renovate Package: saf Package: sqlpad Package: tar Package: tar Package: tileserver-gl Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

Affected products

VendorProductAffectedFixed
isaacs node-tar < 7.5.10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-tar 6.2.1+ds1+~cs6.1.13-8 —
Debian 13 node-tar 6.2.1+~cs7.0.8-1+deb13u1 —
Debian 12 node-tar 6.1.13+~cs7.0.5-1+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS node-tar No fix yet —
Ubuntu 25.10 node-tar No fix yet —
Ubuntu 24.04 LTS node-tar No fix yet —
Ubuntu 22.04 LTS node-tar No fix yet —
Ubuntu 18.04 LTS node-tar No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS node-tar No fix yet —
Ubuntu Pro 16.04 LTS node-tar No fix yet —
Ubuntu Pro 14.04 LTS node-tar No fix yet —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs20 +4 1:20.20.1-1.amzn2023.0.2 ALAS2023-2026-1484
Amazon Linux 2023 nodejs20-npm 1:10.8.2-1.20.20.1.1.amzn2023.0.2 ALAS2023-2026-1484
Amazon Linux 2023 nodejs22 +4 1:22.22.1-1.amzn2023.0.1 ALAS2023-2026-1483
Amazon Linux 2023 nodejs22-npm 1:10.9.4-1.22.22.1.1.amzn2023.0.1 ALAS2023-2026-1483
Amazon Linux 2023 nodejs24 +4 1:24.15.0-1.amzn2023.0.1 ALAS2023-2026-1609
Amazon Linux 2023 nodejs24-npm 1:11.12.1-1.24.15.0.1.amzn2023.0.1 ALAS2023-2026-1609
Amazon Linux 2023 v8-11.3-devel 3:11.3.244.8-1.20.20.1.1.amzn2023.0.2 ALAS2023-2026-1484
Amazon Linux 2023 v8-12.4-devel 3:12.4.254.21-1.22.22.1.1.amzn2023.0.1 ALAS2023-2026-1483
Amazon Linux 2023 v8-13.6-devel 3:13.6.233.17-1.24.15.0.1.amzn2023.0.1 ALAS2023-2026-1609

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 tar +1 No fix yet —
Azure Linux 2 (CBL-Mariner) tar No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jupyter-base-notebook 7.6.3-r2 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling lerna 9.0.7-r1 —
Wolfi rolling node-gyp 12.2.0-r2 —
Wolfi rolling npm 11.11.0-r2 —
Wolfi rolling pnpm-stage0 8.7.4-r7 —
Wolfi rolling prism 5.14.3-r9 —
Wolfi rolling pulumi-language-nodejs 3.224.0-r2 —
Wolfi rolling py3.10-jupyterlab +3 4.6.1-r1 —
Wolfi rolling renovate 43.77.8-r1 —
Wolfi rolling saf 1.6.0-r0 —
Wolfi rolling sqlpad 7.5.7-r13 —
Wolfi rolling tileserver-gl 5.5.0-r8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • Rohitberiwala/NodeJS-Tar-Symlink-Exploit-CVE-2026-29786 ★ 1 · Mar 10, 2026

    Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package (CVE-2026-29786)

  • Jvr2022/CVE-2026-29786 ★ 1 · Mar 5, 2026

    PoC for CVE-2026-29786 demonstrating a node-tar hardlink path traversal that allows overwriting files outside the extraction directory.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm tar < 7.5.10 7.5.10 GHSA-qffp-2rhf-9h96

Advisories 7

References