CVE-2026-26960 node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction
Attackers can read or write arbitrary files by crafting a tar archive with hardlinks escaping the extraction directory via symlinks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26960?
CVE-2026-26960 is a high-severity path traversal vulnerability in isaacs node-tar, published on 20 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
Weakness: CWE-22
Which versions are affected by CVE-2026-26960?
2 open source packages ship an affected version, including tar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tar npm | All versions | 7.5.8 |
tar npm | All versions | 7.5.8 |
Products include Isaacs Tar.
How do I fix CVE-2026-26960?
Upgrade tar to 7.5.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-26960 being exploited?
There is no known exploitation of CVE-2026-26960 in the wild and no public exploit code.
Other vulnerabilities in isaacs node-tar
- CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
- CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
Sources
Also known as CLEANSTART-2026-IA47367, CLEANSTART-2026-NN34341, DEBIAN-CVE-2026-26960, ECHO-73e4-b37f-d747, GHSA-83g3-92jg-28cx, MINI-2cmr-f274-j9g6 and 26 more.