CVE-2026-26960 in node-tar
Summary
by MITRE • 02/20/2026
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/22/2026
The vulnerability identified as CVE-2026-26960 affects the node-tar library, a widely-used tar archive handling component in Node.js environments. This library provides functionality for creating and extracting tar archives within Node.js applications, making it a critical dependency in many development and deployment workflows. The flaw exists in versions 7.5.7 and earlier, where the default extraction behavior fails to properly validate file paths within archive contents. When an attacker crafts a malicious tar archive containing specially constructed file entries, the library's extraction process can create hardlinks that point outside the designated extraction directory, effectively bypassing directory restrictions that should contain file operations within a specific root path.
The technical implementation of this vulnerability stems from insufficient path validation during archive extraction operations. Specifically, the node-tar library does not adequately sanitize or verify the target paths of files being extracted, particularly when dealing with hardlink entries within tar archives. When processing archive contents, the library accepts symbolic links and hardlinks without proper validation of their target paths, allowing an attacker to create hardlinks that reference files outside the intended extraction root. This primitive creates a direct filesystem access mechanism where the extracting user can potentially read or write to any location accessible to that user, regardless of the intended extraction boundaries. The vulnerability operates at the filesystem level, exploiting the fundamental trust placed in archive extraction operations to respect directory boundaries.
The operational impact of this vulnerability is severe and far-reaching across multiple attack scenarios. An attacker with control over a tar archive can leverage this flaw to perform arbitrary file read and write operations on the system where the archive is extracted, potentially leading to privilege escalation, data exfiltration, or system compromise. The vulnerability is particularly dangerous in environments where tar archives are extracted with elevated privileges or in automated build and deployment systems. According to CWE-22, this vulnerability maps directly to improper limitation of a pathname to a restricted directory, while the ATT&CK framework would categorize this under privilege escalation and persistence techniques through file system manipulation. The bypass of path protections makes this a particularly dangerous primitive that can be chained with other vulnerabilities to achieve more significant compromises.
Mitigation strategies for CVE-2026-26960 require immediate action to upgrade the node-tar library to version 7.5.8 or later, which contains the necessary fixes for proper path validation. Organizations should conduct comprehensive audits of their Node.js applications to identify all instances where node-tar is used, particularly in contexts involving untrusted archive inputs. Additional defensive measures include implementing strict input validation for all archive files, using sandboxed environments for archive extraction operations, and configuring proper file system permissions to limit the impact of potential exploitation. Security teams should also consider implementing runtime monitoring to detect suspicious file system access patterns that might indicate exploitation attempts. The fix in version 7.5.8 specifically addresses the hardlink creation vulnerability by implementing proper path validation that ensures all extracted file paths remain within the designated extraction root, preventing the creation of hardlinks that point outside the intended directory boundaries.