Executive brief
npm tar is a Node.js library used to extract tar archive files. A vulnerability in the default extraction behavior allows an attacker to craft a malicious tar archive that, when extracted, can read or write files outside the intended extraction directory as the user running the extraction process. This could lead to exposure of sensitive files or modification of critical application files.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in tar.extract() that leverages a bypass chain combining symlinks and hardlinks. The root cause is that linkpath validation is string-based and does not resolve symlinks on disk before creating hardlinks. An attacker crafts a tar archive with symlinks (a/b/c/up -> ../.., a/b/escape -> c/up/../..) followed by a hardlink (exfil -> a/b/escape/<target>) pointing outside the extraction root. When extracted with default options, the hardlink target is resolved using path.resolve(cwd, entry.linkpath), bypassing the parent directory safety checks that only protect the destination path, not the resolved hardlink target. This allows arbitrary file read/write as the extracting user without requiring elevated privileges, chmod, or the preservePaths option. The patch is available in version 7.5.8 and later.
Affected products
- npm tar <=7.5.7
Timeline
- 2026-02-18: disclosed
- 2026-02-16: patched: Version 7.5.8 and later contains the fix