Page 75
A medium-severity path traversal vulnerability (CVE-2026-24842) in node-tar allowed attackers to create arbitrary files by bypassing hardlink security checks. This vulnerability could enable malicious actors to overwrite critical system files or inject malicious code during tar archive extraction. The recent security patch addresses this exploit vector, protecting applications that process untrusted tar archives.
A medium-severity vulnerability in node-tar (CVE-2026-24842) allowed attackers to create arbitrary files outside intended directories by exploiting Unicode path collisions in hardlink security checks. This race condition could enable malicious tar archives to overwrite critical system files, potentially leading to remote code execution or privilege escalation.
A medium-severity path traversal vulnerability (CVE-2026-24842) has been patched in the popular `node-tar` library. This fix prevents attackers from creating arbitrary files outside the intended extraction directory by exploiting a bypass in the hardlink security check, safeguarding countless Node.js projects that rely on it.