CVE-2026-31802: node-tar Symlink Path Traversal Vulnerability
Summary
CVE-2026-31802: node-tar Symlink Path Traversal via Drive-Relative Linkpath. Affects tar versions < 7.5.11. Fixed in 7.5.11. How to fix ↓
Also tracked for
- tar · npm
The same CVE-2026-31802 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-tar is a comprehensive Tar implementation for Node.js, allowing developers to create and extract tar archives. It is widely used in various applications for handling file archives. However, prior to version 7.5.11, node-tar had a critical vulnerability that could be exploited through symlink manipulation, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the ability of node-tar to be tricked into creating a symlink that points outside the designated extraction directory. This is achieved by using a drive-relative symlink target, such as 'C:../../../target.txt'. As a result, during normal tar.x() extraction, an attacker could overwrite files outside the current working directory, leading to unauthorized access or data loss. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
How To Fix
Minimum fixed version
7.5.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using drive-relative symlink targets in your tar extraction processes until the package is updated. Ensure that any symlink targets are contained within the extraction directory to prevent potential exploitation.
Conclusion
In summary, CVE-2026-31802 presents a significant risk to applications using the node-tar package prior to version 7.5.11. It is crucial to update to the patched version to safeguard against potential exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for tar →
FAQ
CVE-2026-31802 is a vulnerability in the node-tar package that allows for symlink path traversal, potentially leading to file overwrites outside the intended directory.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json file for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized file access and overwriting of critical files, posing significant security risks to your application.
Yes, the vulnerability has been fixed in version 7.5.11 of the node-tar package. Updating to this version will mitigate the risk.
If immediate updates are not possible, ensure that you avoid using drive-relative symlink targets in your tar extraction processes as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for tar.
