CVE-2026-31802: Isaacs Tar Path Traversal Vulnerability

CVE-2026-31802 Overview

CVE-2026-31802 is a path traversal vulnerability [CWE-22] in node-tar, a full-featured Tar implementation for Node.js maintained by isaacs. Versions prior to 7.5.11 mishandle drive-relative symlink targets during archive extraction. An attacker can craft a tar archive containing a symlink with a target such as C:../../../target.txt. When a victim calls tar.x() to extract the archive, the library resolves the path outside the current working directory. This enables arbitrary file overwrite on the host filesystem.

Critical Impact
Malicious tar archives can overwrite files outside the extraction directory through drive-relative symlink targets, leading to integrity compromise and potential code execution in build pipelines.

Affected Products

isaacs node-tar (npm tar package) versions prior to 7.5.11
Node.js applications and CLI tools that invoke tar.x() on untrusted archives
CI/CD pipelines, package managers, and installers that depend on node-tar for archive extraction

Discovery Timeline

2026-03-10 - CVE-2026-31802 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-31802

Vulnerability Analysis

The vulnerability stems from how node-tar normalizes symlink targets during extraction. The library blocks absolute paths and parent directory traversal in standard cases. However, the path sanitization routine does not correctly handle Windows drive-relative paths. A target string of the form C:../../../target.txt is not treated as absolute but is also not normalized through the same logic that strips traversal segments. The result is a symlink that points outside the extraction root.

Once the symlink exists, subsequent file entries in the archive can write through the symlink to arbitrary filesystem locations. Attackers can use this primitive to overwrite configuration files, scripts, or binaries that execute under elevated privileges. The flaw is exploitable on systems where drive-letter parsing applies, but the underlying logic error affects path handling in the cross-platform unpack module.

Root Cause

The root cause is incomplete validation in the symlink path resolution logic inside src/unpack.ts. The function joined the entry directory with the raw symlink target before checking for escape sequences. Drive-relative segments bypassed the startsWith('../') check because the prefix C: masked the traversal pattern.

Attack Vector

An attacker delivers a malicious .tar archive to a target that invokes tar.x() without strict filtering. Exploitation requires local extraction of attacker-controlled content but no authentication or user interaction beyond initiating the extraction.

typescript

// tar paths, not a filesystem.
const entryDir = path.posix.dirname(entry.path)
const resolved = path.posix.normalize(
-  path.posix.join(entryDir, p),
+  path.posix.join(entryDir, parts.join('/'))
)
// If the resolved path escapes (starts with ..), reject it
if (resolved.startsWith('../') || resolved === '..') {

Source: node-tar patch commit f48b5fa. The fix splits the symlink target into path segments and rejoins them, stripping drive-letter prefixes before the escape check executes.

Detection Methods for CVE-2026-31802

Indicators of Compromise

Tar archive entries whose linkname or linkpath field contains drive-letter prefixes such as C:../, D:..\, or similar patterns
Symlinks created during extraction that resolve outside the intended extraction directory
Unexpected file modifications to system paths, user profile directories, or application binaries immediately following a tar.x() operation

Detection Strategies

Inspect tar archives prior to extraction and reject entries where the symlink target contains a colon (:) or matches ^[A-Za-z]:
Audit package.json and lockfiles across the environment for tar dependencies pinned below 7.5.11
Monitor process telemetry for node processes writing to paths outside the declared extraction directory shortly after archive operations

Monitoring Recommendations

Alert on file creation events where the parent path is a symlink that was created within the last several seconds by a Node.js process
Log all invocations of tar.x() in production extraction services and correlate output paths with the configured cwd
Track installation of tar package versions across build agents and developer workstations through software bill of materials tooling

How to Mitigate CVE-2026-31802

Immediate Actions Required

Upgrade the tar npm package to version 7.5.11 or later across all projects, build agents, and container images
Audit transitive dependencies using npm ls tar and force resolutions where downstream packages pin vulnerable versions
Treat all externally sourced tar archives as untrusted and validate entries before extraction

Patch Information

The vulnerability is fixed in node-tar version 7.5.11. The patch is published in commit f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad and documented in GHSA-9ppj-qmqm-q256. Upgrading is the only complete remediation.

Workarounds

Pre-filter archive entries and reject any symlink whose target begins with a drive-letter prefix such as C: or contains .. segments
Extract untrusted archives inside an ephemeral sandbox or container with no write access to sensitive host paths
Disable symlink creation during extraction by setting the filter option in tar.x() to reject entries of type SymbolicLink when symlinks are not required

bash

# Configuration example
npm install tar@7.5.11
npm ls tar
npm audit fix --force