Executive brief
node-tar is a widely-used Node.js package for creating and extracting TAR archives. A security flaw in hardlink extraction allows attackers to craft malicious TAR files that create hardlinks pointing to sensitive files outside the intended extraction directory. An attacker can read arbitrary files accessible to the application process (such as SSH keys or database credentials) or corrupt files if the application later writes through the hardlink, potentially enabling remote code execution or data theft.
Technical details
The vulnerability is a path traversal flaw in lib/unpack.js where hardlink validation and hardlink creation use inconsistent path resolution semantics. The security check (STRIPABSOLUTEPATH) resolves the linkpath relative to the entry's parent directory, while the actual hardlink creation (HARDLINK) resolves it relative to the extraction root directory (cwd). This mismatch allows a crafted TAR entry at a deep path (e.g., a/b/c/d/x) with a linkpath like ../../../../etc/passwd to pass validation (resolves to etc/passwd without ../ prefix) yet escape to the filesystem root during creation (/var/app/uploads/ + ../../../../etc/passwd = /etc/passwd). The attack requires no authentication and exploits TAR extraction with user-controlled archive input. Remediation was released in version 7.5.7.
Affected products
- npm tar <= 7.5.6
Timeline
- 2026-01-28: disclosed: Advisory GHSA-34x7-hfp2-rc4v published
- 2026-01-27: patched: Fix released in version 7.5.7