CVE-2026-24842 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Attackers can exploit a path traversal flaw in node-tar to create hardlinks to arbitrary files, potentially leading to data modification or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-24842?
CVE-2026-24842 is a high-severity path traversal vulnerability in isaacs node-tar, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
Which versions are affected by CVE-2026-24842?
2 open source packages ship an affected version, including tar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tar npm | All versions | 7.5.7 |
tar npm | All versions | 7.5.7 |
Linux distribution packages (1)
pnpm openSUSE:Tumbleweed | All versions | 10.32.1-1.1 |
Products include Isaacs Tar.
How do I fix CVE-2026-24842?
Upgrade tar to 7.5.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24842 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24842 exists.
Other vulnerabilities in isaacs node-tar
- CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
- CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
Sources
Also known as CLEANSTART-2026-RV26689, CLEANSTART-2026-WI35354, DEBIAN-CVE-2026-24842, ECHO-60e5-49eb-41f5, GHSA-34x7-hfp2-rc4v, MINI-27cj-2277-vcqf and 27 more.