CVE-2026-23745 node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Attackers can overwrite arbitrary files or poison symlinks via malicious tar archives, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23745?
CVE-2026-23745 is a high-severity path traversal vulnerability in isaacs node-tar, published on 16 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-23745?
2 open source packages ship an affected version, including tar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tar npm | All versions | 7.5.3 |
tar npm | All versions | 7.5.3 |
Products include Isaacs Tar.
How do I fix CVE-2026-23745?
Upgrade tar to 7.5.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23745 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23745 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in isaacs node-tar
- CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
- CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
Sources
Also known as CLEANSTART-2026-FG94911, CLEANSTART-2026-ZI47888, DEBIAN-CVE-2026-23745, ECHO-fcdb-3d59-4763, GHSA-8qq5-rm4j-mr97, MINI-3636-4c9j-259m and 23 more.