CVE-2026-31802 Details
Description
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.
A symlink path traversal vulnerability has been identified in node-tar, a tar manipulation library for Node.js. This issue affects versions through 7.5.10. The vulnerability arises because the extraction process can be manipulated to create a symlink pointing outside the designated extraction directory. By using a drive-relative symlink target, such as 'C:../../../target.txt', it is possible to overwrite files outside the current working directory during the extraction process. This vulnerability is particularly concerning when tar archives controlled by an attacker are extracted using the tar.x() method, as it allows for arbitrary file overwriting on the system.
Users should upgrade to node-tar version 7.5.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad | [email protected] | Vendor Advisory |
| https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| isaacs tar | < 7.5.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |