GHSA-9ppj-qmqm-q256
NoneCVSS
—
EPSS
—
Published
Mar 10, 2026
CISA due date
—
The record
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tar | 0 | 7.5.11 |
| Chainguard | actions-runner | 0 | 2.332.0-r2 |
| Chainguard | graalvm-25-ce-nodejs | 0 | 25.0.2-r5 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r13 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r13 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r13 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r11 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r14 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r14 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r14 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 0 | 9.2.6-r1 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.6-r1 |
| Chainguard | kibana-9.3 | 0 | 9.3.1-r1 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.1-r1 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r15 |
| Chainguard | lerna | 0 | 9.0.7-r1 |
| Chainguard | node-gyp | 0 | 12.2.0-r2 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | pulumi-language-nodejs | 0 | 3.224.0-r2 |
| Chainguard | renovate | 0 | 43.77.8-r1 |
| Chainguard | sqlpad | 0 | 7.5.7-r13 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r8 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r9 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r15 |
| Wolfi | lerna | 0 | 9.0.7-r1 |
| Wolfi | node-gyp | 0 | 12.2.0-r2 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Wolfi | pulumi-language-nodejs | 0 | 3.224.0-r2 |
| Wolfi | renovate | 0 | 43.77.8-r1 |
| Wolfi | sqlpad | 0 | 7.5.7-r13 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r8 |
Related vulnerabilities
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Same vulnerability
- CVE-2026-53655 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers… Also affects tar
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-26960 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-83g3-92jg-28cx Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar… Also affects tar
- GHSA-34x7-hfp2-rc4v node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal Also affects tar