CVE-2026-29786

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.10

Description A flaw in the extraction logic allows an attacker to create a hardlink that points outside the intended extraction directory. By using a drive-relative link target, such as C:../target.txt, the software can be tricked into bypassing path restrictions. This occurs because the logic checks for .. segments before stripping absolute roots, allowing the linkpath to escape the current working directory (cwd) during the execution of the tar.x() function. This results in an arbitrary file overwrite primitive with the permissions of the process performing the extraction, which is particularly critical for services that unpack untrusted archives or build pipelines consuming third-party files.

Recommendations Update node-tar to version 7.5.10 or later.