CVE-2026-29786 Details

A path traversal vulnerability has been identified in node-tar versions prior to 7.5.10. The issue arises when tar is tricked into creating a hardlink that points outside the extraction directory using a drive-relative link target. This manipulation enables overwriting of files outside the current working directory during the extraction process. The vulnerability is rooted in the extraction logic, which fails to properly sanitize link paths before processing, allowing for exploitation by overwriting targeted files outside the intended extraction area.

Users are advised to update node-tar to version 7.5.10 or later, where this vulnerability has been patched.