Is CVE-2026-23745 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23745 being exploited in the wild.

How severe is CVE-2026-23745?

Medium severity, with a CVSS score of 6.1, published 16 January 2026.

Which products and versions are affected?

tar (npm) SEMVER:introduced=0,fixed=7.5.3; Red Hat Enterprise Linux AppStream 9, 10.

Is there a fix for CVE-2026-23745?

Yes. tar (npm): upgrade to 7.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23745 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-23745?

Check whether you run tar (npm) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23745: node-tar path traversal via insufficient linkpath sanitization

CVE-2026-23745 · Severity: medium · CVSS 6.1 · Published 2026-01-16

node-tar is a popular software library used by developers to create and extract compressed archive files. A security flaw in the library allows a malicious archive to trick the software into writing files outside of the intended folder or creating links to sensitive system files. If an automated system or user extracts a specially crafted archive, an attacker could overwrite critical application files or gain access to sensitive information, potentially leading to a full system takeover in automated environments like build servers.

Technologies: tar (npm), Red Hat Enterprise Linux AppStream. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-23745 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23745 being exploited in the wild.
How severe is CVE-2026-23745?: Medium severity, with a CVSS score of 6.1, published 16 January 2026.
Which products and versions are affected?: tar (npm) SEMVER:introduced=0,fixed=7.5.3; Red Hat Enterprise Linux AppStream 9, 10.
Is there a fix for CVE-2026-23745?: Yes. tar (npm): upgrade to 7.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23745 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-23745?: Check whether you run tar (npm) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tar (npm): upgrade to 7.5.3 or later
```
npm install tar@7.5.3
```

Technical details

The vulnerability exists in the [HARDLINK] and [SYMLINK] methods within src/unpack.ts. When processing a 'Link' entry, the library uses path.resolve() with the user-provided linkpath; if this path is absolute, Node.js ignores the current working directory (cwd), allowing the hardlink to point anywhere on the file system. For 'SymbolicLink' entries, the library passes the linkpath directly to fs.symlink without validation. An attacker can exploit this by crafting a TAR archive with absolute paths or traversal sequences in the linkpath header. This enables arbitrary file overwrites (if the process has sufficient permissions) and symlink poisoning. The issue is fixed in version 7.5.3 by properly sanitizing absolute linkpaths.

Affected products

node-tar tar <= 7.5.2
Red Hat Enterprise Linux AppStream 9, 10
Red Hat OpenShift AI 2.25, 3.3

Identifiers

CVE-2026-23745
GHSA-8qq5-rm4j-mr97

Timeline

2026-01-16: advisory: GitHub Advisory GHSA-8qq5-rm4j-mr97 published
2026-01-16: disclosed: CVE-2026-23745 published to NVD
2026-01-16: patched: Fixed in node-tar version 7.5.3
2026-05-19: patched: Red Hat released security updates for REL 10 (RHSA-2026:18480)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.