GHSA-34x7-hfp2-rc4v
High · 8.2CVSS
8.2
EPSS
—
Published
Jan 28, 2026
CISA due date
—
The record
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tar | 0 | 7.5.7 |
| Chainguard | actions-runner | 0 | 2.331.0-r1 |
| Chainguard | code-server | 0 | 4.106.3-r4 |
| Chainguard | graalvm-25-ce-nodejs | 0 | 25.0.2-r1 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r9 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r9 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r9 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r9 |
| Chainguard | kibana-8.19 | 0 | 8.19.11-r0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.11-r0 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r9 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r9 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r9 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r4 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r4 |
| Chainguard | kibana-9.2 | 0 | 9.2.5-r0 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.5-r0 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Chainguard | lerna | 0 | 9.0.4-r1 |
| Chainguard | node-gyp | 0 | 12.2.0-r1 |
| Chainguard | npm | 0 | 11.9.0-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r0 |
| Chainguard | prism | 0 | 5.14.3-r5 |
| Chainguard | pulumi-language-nodejs | 0 | 3.217.1-r2 |
| Chainguard | redisinsight | 0 | 3.0.2-r2 |
| Chainguard | renovate | 0 | 43.3.1-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r9 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r2 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r3 |
| Chainguard | vitess-22 | 0 | 22.0.3-r0 |
| Chainguard | vitess-23 | 0 | 23.0.1-r0 |
| Wolfi | code-server | 0 | 4.106.3-r4 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Wolfi | lerna | 0 | 9.0.4-r1 |
| Wolfi | node-gyp | 0 | 12.2.0-r1 |
| Wolfi | npm | 0 | 11.9.0-r0 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Wolfi | prism | 0 | 5.14.3-r5 |
| Wolfi | pulumi-language-nodejs | 0 | 3.217.1-r2 |
| Wolfi | renovate | 0 | 43.3.1-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r9 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r2 |
| Wolfi | vitess-22 | 0 | 22.0.3-r0 |
| Wolfi | vitess-23 | 0 | 23.0.1-r0 |
Related vulnerabilities
- CVE-2026-24842 node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the… Same vulnerability
- CVE-2026-53655 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers… Also affects tar
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects tar
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-26960 node-tar is a full-featured Tar for Node.js. Also affects tar