CVE-2026-23745

VendorisaacsProducttarDiscoveredJan 16, 2026UpdatedSep 7, 2026

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

View graph Watch Export

CVSS v3.1

6.1 MEDIUM

EPSS

0.38%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 22, 2026

▲ 0.04pp

0.34% → 0.38% over 4 tracked changes

CVSS v3.1 Detail

Attack VectorLOCAL

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityLOW

AvailabilityNONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Connections

2 relationships

CWE-22

source

Timeline

disclosure → media coverage

Jan 16, 2026

Disclosure — published as a CVE record. · last revised by NVD Sep 7, 2026

Public PoC (3)

github.com/Jvr2022/CVE-2026-23745 github.com/Novem13th/CVE-2026-23745-via-graphql-DEMO github.com/OndrejDrapalik/node-tar-cve-demo

Unverified third-party code — review before executing.