Read the docs
TI-2026-21445 Aliases CVE-2026-26960GHSA-83g3-92jg-28cx

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-tar (isaacs): 7.5.8tar (npm): 7.5.8Red Hat: 3 advisoriesRed Hat: 3 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isaacsnode-tarbefore 7.5.87.5.8Patch availableCNA
—tar (npm)before 7.5.87.5.8Patch availableGHSA-83g3-92jg-28cx
  • node-tar Vendorisaacs Affected before 7.5.8 Fixed in 7.5.8 Patch available CNA
  • tar (npm) Vendor— Affected before 7.5.8 Fixed in 7.5.8 Patch available GHSA-83g3-92jg-28cx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*before 7.5.8Vulnerableisaacs
  • cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* Versions before 7.5.8 Vulnerable ·isaacs

Remediation

  • Fix · CNA node-tar (isaacs) Fixed in 7.5.8
  • Fix · GHSA-83g3-92jg-28cx tar (npm) Fixed in 7.5.8 Advisory →

Red Hat 3 advisories

  • RHSA-2026:6428 Released 2026-04-02 · Red Hat rating Important
    Network Observability 1.11.1 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +3
  • RHSA-2026:6192 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.0 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:5447 Released 2026-03-23 · Red Hat rating Important
    RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:6428
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:6192
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:5447
Not affected: 18 products
  • Cryostat 4
  • Network Observability (NETOBSERV) 1.11.0
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Process Automation 7
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Apache Camel - HawtIO 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26960
  2. 2026-10-03 Alias added: GHSA-83g3-92jg-28cx
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
  • TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
  • TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
  • TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-20041 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVSS 3.1HIGH 8.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences