GHSA-8qq5-rm4j-mr97
NoneCVSS
—
EPSS
—
Published
Jan 16, 2026
CISA due date
—
The record
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tar | 0 | 7.5.3 |
| Chainguard | actions-runner | 0 | 2.331.0-r1 |
| Chainguard | code-server | 0 | 4.106.3-r2 |
| Chainguard | graalvm-25-ce-nodejs | 0 | 25.0.2-r1 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r8 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r8 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r8 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r8 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r8 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r8 |
| Chainguard | kibana-8.19 | 0 | 8.19.10-r2 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.10-r2 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r8 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r8 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r8 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r3 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r3 |
| Chainguard | kibana-9.2 | 0 | 9.2.3-r5 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.3-r5 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r10 |
| Chainguard | lerna | 0 | 9.0.3-r1 |
| Chainguard | node-gyp | 0 | 12.2.0-r0 |
| Chainguard | npm | 0 | 11.8.0-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r0 |
| Chainguard | prism | 0 | 5.14.3-r2 |
| Chainguard | pulumi-language-nodejs | 0 | 3.215.0-r1 |
| Chainguard | redisinsight | 0 | 3.0.2-r1 |
| Chainguard | renovate | 0 | 43.2.4-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r6 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r2 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r3 |
| Chainguard | vitess-22 | 0 | 22.0.3-r0 |
| Chainguard | vitess-23 | 0 | 23.0.1-r0 |
| Wolfi | code-server | 0 | 4.106.3-r2 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r10 |
| Wolfi | lerna | 0 | 9.0.3-r1 |
| Wolfi | node-gyp | 0 | 12.2.0-r0 |
| Wolfi | npm | 0 | 11.8.0-r0 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Wolfi | prism | 0 | 5.14.3-r2 |
| Wolfi | pulumi-language-nodejs | 0 | 3.215.0-r1 |
| Wolfi | renovate | 0 | 43.2.4-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r6 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r2 |
| Wolfi | vitess-22 | 0 | 22.0.3-r0 |
| Wolfi | vitess-23 | 0 | 23.0.1-r0 |
Related vulnerabilities
- CVE-2026-23745 node-tar is a Tar for Node.js. Same vulnerability
- CVE-2026-53655 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers… Also affects tar
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects tar
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-26960 node-tar is a full-featured Tar for Node.js. Also affects tar