CVE-2018-20834 in node-tar
Summary
by MITRE
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/04/2026
The vulnerability identified as CVE-2018-20834 represents a critical arbitrary file overwrite flaw within the node-tar package ecosystem, affecting versions prior to 4.4.2 with a notable exception for version 2.2.2 which received a specific patch. This security weakness arises from improper handling of file extraction processes when tar archives contain hardlink entries that reference existing system files. The flaw specifically manifests when a tarball includes a hardlink pointing to a file that already exists on the target system, followed by a subsequent plain file entry with identical naming conventions. This sequence creates a condition where the extraction process fails to properly distinguish between hardlink and regular file operations, leading to unintended overwrites of existing system files with the content from the plain file entry.
The technical implementation of this vulnerability stems from the inadequate validation of file system state during tar extraction operations. When node-tar encounters a hardlink entry, it should verify whether the target file already exists and handle the scenario appropriately to prevent overwriting. However, the flawed implementation fails to maintain proper state tracking between hardlink and regular file entries, causing the extraction engine to treat subsequent plain file entries as direct replacements for existing files rather than recognizing the logical relationship established by the hardlink. This behavior creates a path for malicious actors to exploit by crafting tar archives that manipulate file system permissions and content through carefully constructed hardlink and file entry sequences.
The operational impact of CVE-2018-20834 extends beyond simple file overwrites to potentially enable privilege escalation and system compromise scenarios. Attackers can leverage this vulnerability to overwrite critical system binaries, configuration files, or sensitive data files with malicious content, particularly when the target system has elevated privileges during the extraction process. The vulnerability aligns with CWE-59, which describes improper handling of file operations, and represents a specific case of CWE-22 related to path traversal vulnerabilities. When exploited in environments where node-tar is used for package installation or system deployment operations, this flaw can result in persistent backdoors, data corruption, or unauthorized access to system resources.
Mitigation strategies for CVE-2018-20834 primarily focus on immediate version upgrades to node-tar 4.4.2 or later, with special attention to the patched version 2.2.2 which specifically addresses this issue. System administrators should conduct comprehensive audits of applications and services that rely on node-tar for package management or archive extraction to identify potential exposure points. The vulnerability also highlights the importance of implementing proper file system access controls and monitoring for unauthorized file modifications during extraction operations. Organizations should consider implementing additional security controls such as signature verification of packages, sandboxed extraction environments, and regular security scanning of dependency trees to prevent exploitation. This vulnerability demonstrates the critical importance of maintaining up-to-date dependencies and implementing proper input validation in archive processing libraries, aligning with ATT&CK technique T1059.007 for execution through node.js and T1078.004 for valid accounts with elevated privileges.