CVE-2026-23745: node-tar Path Traversal Vulnerability

CVE-2026-23745 Overview

CVE-2026-23745 is a Path Traversal vulnerability in node-tar, a widely-used Tar library for Node.js. The library versions <= 7.5.2 fail to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is set to false (the default secure behavior). This oversight allows malicious archives to bypass extraction root restrictions, enabling Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets.

Critical Impact

Attackers can craft malicious tar archives that, when extracted, overwrite arbitrary files on the target system or create poisoned symlinks pointing to sensitive locations outside the intended extraction directory.

Affected Products

• node-tar versions <= 7.5.2
• Applications using node-tar for tar archive extraction
• npm packages and build systems dependent on node-tar

Discovery Timeline

• January 16, 2026 - CVE-2026-23745 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23745

Vulnerability Analysis

This vulnerability (CWE-22: Path Traversal) exists in the node-tar library's handling of hardlink and symbolic link entries during archive extraction. When extracting tar archives, node-tar is expected to sanitize paths to prevent files from being written outside the designated extraction directory. However, the library failed to properly sanitize the linkpath property of Link and SymbolicLink entries, even when the preservePaths option was explicitly set to false.

The preservePaths: false setting is intended to strip absolute paths and prevent directory traversal sequences like ../ from escaping the extraction root. While this protection was correctly applied to regular file entries, the same sanitization was not properly enforced for the target paths of hardlinks and symlinks.

Root Cause

The root cause is insufficient input validation on the linkpath attribute of Link and SymbolicLink tar entries. The extraction logic correctly sanitizes the entry name (where the link is created) but fails to apply the same sanitization to the link target path. This allows an attacker to:

1. Create a hardlink pointing to an absolute path outside the extraction directory
2. Create a symbolic link with an absolute target pointing to sensitive system files
3. Use these links as intermediaries for subsequent file operations

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious tar archive containing entries with specially crafted linkpath values. The attack requires local access and user interaction—a victim must extract the malicious archive using an application that relies on vulnerable versions of node-tar.

Attack scenarios include:

• Arbitrary File Overwrite: A hardlink entry with linkpath pointing to /etc/passwd or application configuration files, followed by a regular file entry that overwrites the link target
• Symlink Poisoning: A symbolic link with an absolute target path that can be used to read or write sensitive files during subsequent operations
• Privilege Escalation Chain: Overwriting system configuration files, cron jobs, or SSH authorized keys

The security patch introduces proper sanitization of absolute linkpaths:

 const HARDLINK = Symbol('hardlink')
 const UNSUPPORTED = Symbol('unsupported')
 const CHECKPATH = Symbol('checkPath')
+const STRIPABSOLUTEPATH = Symbol('stripAbsolutePath')
 const MKDIR = Symbol('mkdir')
 const ONERROR = Symbol('onError')
 const PENDING = Symbol('pending')

Source: GitHub Commit Changes

Detection Methods for CVE-2026-23745

Indicators of Compromise

• Unexpected hardlinks or symlinks appearing outside intended extraction directories
• Modified system configuration files following tar extraction operations
• Anomalous file permission changes on sensitive files after running npm scripts or build processes
• Log entries showing file access to paths outside the expected extraction root during archive operations

Detection Strategies

• Monitor for file system operations that create links pointing outside application directories
• Implement file integrity monitoring on critical system files and configuration directories
• Audit npm package dependencies for node-tar versions <= 7.5.2 using npm audit or similar tools
• Deploy SentinelOne agents to detect unusual file system traversal patterns during archive extraction

Monitoring Recommendations

• Enable detailed logging for applications performing tar extraction operations
• Monitor for suspicious tar archives with entries containing absolute paths or ../ sequences in linkpath fields
• Track file modifications to sensitive directories following any archive extraction activity
• Implement automated dependency scanning in CI/CD pipelines to identify vulnerable node-tar versions

How to Mitigate CVE-2026-23745

Immediate Actions Required

• Upgrade node-tar to version 7.5.3 or later immediately
• Run npm audit across all projects to identify vulnerable dependencies
• Review and update any lockfiles (package-lock.json, yarn.lock) to ensure patched versions are resolved
• Consider implementing additional input validation for tar archives from untrusted sources

Patch Information

The vulnerability is fixed in node-tar version 7.5.3. The patch adds a new STRIPABSOLUTEPATH symbol and applies proper sanitization to linkpath values in both hardlink and symlink entries. Review the security advisory for complete details on the fix.

Update using npm:

Workarounds

• Avoid extracting tar archives from untrusted sources until patching is complete
• Implement manual validation of archive contents before extraction using tar -tvf to inspect entries
• Use containerization or sandboxing to isolate archive extraction operations from sensitive file systems
• Configure restricted write permissions on critical system directories to limit impact

# Update node-tar to patched version
npm update tar@7.5.3

# Verify installed version
npm list tar

# Run security audit
npm audit

# Force update for nested dependencies
npm update tar --depth=10