Junglewise Threat Intelligence

CVE-2026-23745: node-tar path traversal via insufficient linkpath sanitization

CVE-2026-23745 · Severity: medium · CVSS 6.1 · Published 2026-01-16

Technologies: Red Hat Enterprise Linux AppStream, Node-Tar Tar. Vendors: Red Hat.

Executive brief

node-tar is a popular software library used by developers to create and extract compressed archive files. A security flaw in the library allows a malicious archive to trick the software into writing files outside of the intended folder or creating links to sensitive system files. If an automated system or user extracts a specially crafted archive, an attacker could overwrite critical application files or gain access to sensitive information, potentially leading to a full system takeover in automated environments like build servers.

Technical details

The vulnerability exists in the [HARDLINK] and [SYMLINK] methods within src/unpack.ts. When processing a 'Link' entry, the library uses path.resolve() with the user-provided linkpath; if this path is absolute, Node.js ignores the current working directory (cwd), allowing the hardlink to point anywhere on the file system. For 'SymbolicLink' entries, the library passes the linkpath directly to fs.symlink without validation. An attacker can exploit this by crafting a TAR archive with absolute paths or traversal sequences in the linkpath header. This enables arbitrary file overwrites (if the process has sufficient permissions) and symlink poisoning. The issue is fixed in version 7.5.3 by properly sanitizing absolute linkpaths.

Affected products

  • node-tar tar <= 7.5.2
  • Red Hat Enterprise Linux AppStream 9, 10
  • Red Hat OpenShift AI 2.25, 3.3

Timeline

  • 2026-01-16: advisory: GitHub Advisory GHSA-8qq5-rm4j-mr97 published
  • 2026-01-16: disclosed: CVE-2026-23745 published to NVD
  • 2026-01-16: patched: Fixed in node-tar version 7.5.3
  • 2026-05-19: patched: Red Hat released security updates for REL 10 (RHSA-2026:18480)

References

Related threats