CVE-2026-31802
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Summary
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Original description
The description as published by the source.
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-31802 node-tar Fixed in: 6.0.5+ds1+~cs11.3.9-1+deb11u3
- Ubuntu UBUNTU-CVE-2026-31802 node-tar
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com