CVE-2026-29786

A flaw was found in node-tar. A hardlink that points outside the extraction directory can be created by using a drive-relative link target such as C:../target.txt, allowing a file overwrite outside the current working directory during normal tar.x() extraction.

To exploit this flaw, an attacker must be able to supply a specially crafted archive to be processed by an application using node-tar. Additionally, this vulnerability allows files to be extracted outside the intended directory but it is still limited to the permissions of the node-tar application processing the archive. Due to this reason, this flaw has been rated with an important severity.

This vulnerability does not affect node-tar running on Unix-like systems as it relies on a drive-relative link target to be exploited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.