CVE-2026-31802

What it actually does

Prior to node-tar 7.5.11, tar archive extraction can mishandle Windows drive-relative symlink targets such as `C:../../../target.txt`. During normal `tar.x()` extraction, a malicious archive can create a symbolic link that resolves outside the intended extraction directory. Subsequent extraction steps may then write through that symlink and overwrite files outside the configured working directory. The primary impact is integrity compromise of files reachable by the extracting process; confidentiality and availability impact are not the main characteristics of this flaw.

Why it matters to the business

Applications, build systems, developer tools, CI/CD jobs, package processing services, or automation that extract untrusted tar archives with vulnerable versions of the npm `tar` package could overwrite files outside the intended extraction area. This can corrupt application files, alter configuration, poison build artifacts, or potentially set up further compromise if sensitive executable or configuration files are overwritten. The current EPSS is low and the vulnerability is not in CISA KEV, but it should still be prioritized where archives come from users, third parties, package registries, or automated supply-chain workflows.

How an attack unfolds

An attacker prepares a tar archive containing a specially crafted symbolic link whose target uses a drive-relative path form, for example `C:../../../target.txt`. The vulnerable extraction logic treats the path as acceptable during extraction, allowing the symlink to point outside the destination directory. The attacker then includes additional archive entries that write through or interact with that symlink. When a vulnerable application or build process calls `tar.x()` on the archive, files outside the extraction directory may be overwritten with attacker-controlled content. Practical impact depends on the privileges of the extracting process and which filesystem paths are reachable.

How to fix it

Upgrade the npm `tar` package to version 7.5.11 or later wherever it is used directly or transitively. Regenerate lockfiles after upgrading and verify that deployed artifacts do not still include vulnerable nested copies. If immediate upgrade is not possible, avoid extracting untrusted tar archives, disable or reject symlink entries during extraction where feasible, extract archives inside a tightly permissioned temporary sandbox, run extraction with the least-privileged account possible, and validate archive entries before extraction. On Windows or cross-platform systems, specifically reject symlink targets that use drive-relative traversal patterns such as `C:../` or `C:../../../`.

How to confirm the fix worked

Confirm dependency resolution shows `tar` version 7.5.11 or later in package manifests and lockfiles, including transitive dependency trees using tools such as `npm ls tar`, software composition analysis, or SBOM inspection. Validate runtime/container images as well as source repositories, because vulnerable copies may remain in built artifacts. Where feasible, run a controlled regression test using a tar archive containing a drive-relative symlink target and verify extraction does not create or overwrite files outside the intended directory. Confirm archive extraction runs with restricted filesystem permissions and that symlink-containing archives are rejected or safely handled if mitigation controls are used.

Typical attack path

1. Identify an application, service, developer workflow, or CI/CD process that extracts tar archives using npm `tar` before 7.5.11.
2. Submit or introduce a malicious tar archive to that workflow, such as through upload, import, dependency ingestion, artifact processing, or build automation.
3. Include a symbolic link entry with a Windows drive-relative traversal target such as `C:../../../target.txt`.
4. Include follow-on archive entries intended to write attacker-controlled content through the symlink or into paths outside the extraction directory.
5. Wait for the vulnerable process to run `tar.x()` and extract the archive.
6. Achieve overwrite of files outside the intended extraction directory, potentially modifying configuration, source files, build outputs, or other files writable by the extraction process.

How to detect it

Look for evidence that untrusted tar archives were processed by applications or build workflows using vulnerable npm `tar` versions before 7.5.11. Relevant sources include application upload/import logs, CI/CD job logs, artifact processing logs, endpoint file creation/modification telemetry, EDR events, filesystem audit logs, and records of extracted archive contents. Hunt for tar archives containing symbolic link entries whose link target begins with a Windows drive-relative prefix followed by traversal, such as `C:../` or another drive letter with `../`. Review file modification events occurring immediately after archive extraction, especially writes outside expected temporary extraction directories. In CI/CD environments, compare modified files and build outputs around archive extraction events for unexpected changes to configuration files, scripts, package manifests, lockfiles, startup files, or generated artifacts. No public exploitation or named threat actors are currently identified from the provided data, so detection should focus on suspicious archive structure and unauthorized file overwrites rather than actor-specific infrastructure.

• C:../../../
• C:../../
• C:../
• D:../../../
• D:../../
• D:../
• E:../../../
• E:../../
• E:../
• tar.x(
• node_modules/tar/package.json
• "tar": "7.5.10"
• "tar": "7.5.9"
• "tar": "7.5.8"

What your security team should do

• Inventory all applications, build jobs, developer tools, and services that use the npm `tar` package or extract tar archives from untrusted sources.
• Upgrade `tar` to 7.5.11 or later and rebuild/redeploy affected applications and container images.
• Prioritize internet-facing upload/import features, package ingestion systems, artifact processors, and CI/CD pipelines that process third-party archives.
• Search dependency lockfiles and SBOMs for vulnerable `tar` versions prior to 7.5.11, including transitive dependencies.
• Add archive-validation controls that reject symlinks with drive-relative or traversal-like targets before extraction.
• Run extraction workloads with least privilege in disposable directories or containers so file overwrite impact is contained.
• Review recent archive-processing activity for suspicious symlink targets or unexpected file modifications outside extraction directories.
• Add tests to ensure future archive handling cannot write outside the intended destination directory.