CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NCVE-2026-24842
High (8.2) in isaacs tar. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in tar 7.5.7.
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Affected
- isaacs:tar
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-34x7-hfp2-rc4v | npm | tar | <7.5.7 | 7.5.7 |