CVE-2026-29786 - Vulnerability Analysis

Overview

node-tar < 7.5.10 contains a path traversal caused by drive-relative hardlink targets during extraction, letting attackers overwrite files outside the extraction directory, exploit requires crafted archive.

Severity & Score

Impact

Attackers can overwrite arbitrary files outside the extraction directory, potentially leading to system compromise or data loss.

Mitigation

Update to version 7.5.10 or later.

References

• https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f
• https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner