Node.js Tar Package Vulnerability Allows File Overwrite Outside Directory
CVE-2026-29786
8.2HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-29786?
The node-tar package for Node.js has a vulnerability that allows an attacker to create a hardlink pointing outside of the designated extraction directory. This occurs when a drive-relative link target is used, such as C:../target.txt, potentially leading to unintended file overwrites outside the current working directory during the normal tar.x() extraction process. This issue has been resolved in version 7.5.10 of the node-tar package.
Affected Version(s)
node-tar < 7.5.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.