CVE-2026-24842

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-24842 affects node-tar, a Tar implementation for Node.js, in versions prior to 7.5.7. The vulnerability arises from a mismatch in path resolution semantics: the security check for hardlink entries uses different logic than the actual hardlink creation process during TAR extraction. This discrepancy enables attackers to craft malicious TAR archives that bypass path traversal protections, allowing hardlinks to be created to arbitrary files outside the intended extraction directory. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-59 (Improper Link Resolution Before File Access), with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). It was published on 2026-01-28.

An attacker can exploit this vulnerability remotely over the network with low complexity and no required privileges, but it requires user interaction, such as tricking a victim into extracting a malicious TAR archive using an affected version of node-tar. Successful exploitation changes the scope to high, enabling high-impact confidentiality violations by creating hardlinks to sensitive files outside the extraction directory. This allows arbitrary file reads (e.g., linking to system files and accessing them via the extraction directory), with low integrity impact and no availability disruption.

The node-tar GitHub security advisory (GHSA-34x7-hfp2-rc4v) and the fixing commit (f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46) confirm that upgrading to version 7.5.7 resolves the issue by aligning the path resolution semantics in the security check with the hardlink creation logic. Security practitioners should prioritize updating affected node-tar instances and validate TAR archives before extraction where possible.