Arbitrary File Read and Write Vulnerability in Node.js Tar by Isaac's

CVE-2026-26960

What is CVE-2026-26960?

The node-tar library for Node.js has a significant vulnerability that allows an attacker to create hardlinks to files outside the extraction directory when using default options in versions 7.5.7 and earlier. This flaw bypasses standard path protections during archive extraction, granting the extracting user arbitrary read and write access to the filesystem. This vulnerability highlights the importance of secure package handling and has been rectified in version 7.5.8, where enhanced safeguards prevent such exploitation.

References