CVE-2026-26960
Fixed in a distro release EPSS <1%CVSS 7.1
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
Products: isaacs node-tar
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | tar | 7.5.8 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.332.0-r0 |
| Chainguard | code-server | 4.106.3-r5 |
| Chainguard | drupal-11.3 | 11.3.13-r3 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r31 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r12 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.4-r10 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r8 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.2-r2 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r15 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r61 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.4-r7 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.2-r9 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r4 |
| Chainguard | graalvm-24-ce-nodejs | no fix |
| Chainguard | graalvm-25-ce-nodejs | 25.0.2-r2 |
| Chainguard | jupyter-base-notebook | 7.6.3-r2 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kibana-7 | no fix |
| Chainguard | kibana-8.17 | 8.17.10-r10 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r10 |
| Chainguard | kibana-8.19 | 8.19.11-r1 |
| Chainguard | kibana-8.19-bitnami | 8.19.11-r1 |
| Chainguard | kibana-8.19-iamguarded | 8.19.11-r1 |
| Chainguard | kibana-9.0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r10 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r10 |
| Chainguard | kibana-9.1 | 9.1.10-r5 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r5 |
| Chainguard | kubeflow-pipelines-frontend | 2.15.0-r12 |
| Chainguard | lerna | 9.0.4-r3 |
| Chainguard | node-gyp | 12.2.0-r2 |
| Chainguard | npm | 11.10.1-r0 |
| Chainguard | opensearch-dashboards-2 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-3 | 3.5.0-r5 |
| Chainguard | opensearch-dashboards-3-fips | 3.5.0-r3 |
| Chainguard | pnpm-stage0 | 8.7.4-r7 |
| Chainguard | prism | 5.14.3-r7 |
| Chainguard | pulumi-language-nodejs | 3.223.0-r1 |
| Chainguard | py3.10-jupyterlab | 4.6.1-r1 |
| Chainguard | py3.11-jupyterlab | 4.6.1-r1 |
| Chainguard | py3.12-jupyterlab | 4.6.1-r1 |
| Chainguard | py3.13-jupyterlab | 4.6.1-r1 |
| Chainguard | renovate | 43.38.0-r1 |
| Chainguard | saf | 1.6.0-r0 |
| Chainguard | sqlpad | 7.5.7-r10 |
| Chainguard | tensorflow-cpu-jupyter | 2.21.0-r8 |
| Chainguard | tensorflow-gpu-jupyter | 0 |
| Chainguard | tileserver-gl | 5.5.0-r5 |
| Chainguard | tileserver-gl-fips | 5.5.0-r6 |
| Chainguard | vitess-21 | no fix |
| Chainguard | vitess-22 | 22.0.3-r2 |
| Chainguard | vitess-23 | 23.0.2-r1 |
| Chainguard | wazuh-dashboard | 4.14.5-r0 |
| Chainguard | wazuh-dashboard-fips | 4.14.5-r0 |
| Debian 12 | node-tar | 6.1.13+~cs7.0.5-1+deb12u1 |
| Debian 13 | node-tar | 6.2.1+~cs7.0.8-1+deb13u1 |
| Debian 14 | node-tar | 6.2.1+ds1+~cs6.1.13-8 |
| Ubuntu 18.04 LTS | node-tar | no fix |
| Ubuntu 22.04 LTS | node-tar | no fix |
| Ubuntu 24.04 LTS | node-tar | no fix |
| Ubuntu 25.10 | node-tar | no fix |
| Ubuntu 26.04 LTS | node-tar | no fix |
| Ubuntu 26.10 | node-tar | no fix |
| Ubuntu Pro 14.04 LTS | node-tar | no fix |
| Ubuntu Pro 16.04 LTS | node-tar | no fix |
| Ubuntu Pro 20.04 LTS | node-tar | no fix |
| Wolfi | code-server | 4.106.3-r5 |
| Wolfi | jupyter-base-notebook | 7.6.3-r2 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kubeflow-pipelines-frontend | 2.15.0-r12 |
| Wolfi | lerna | 9.0.4-r3 |
| Wolfi | node-gyp | 12.2.0-r2 |
| Wolfi | npm | 11.10.1-r0 |
| Wolfi | opensearch-dashboards-3 | 3.5.0-r5 |
| Wolfi | pnpm-stage0 | 8.7.4-r7 |
| Wolfi | prism | 5.14.3-r7 |
| Wolfi | pulumi-language-nodejs | 3.223.0-r1 |
| Wolfi | py3.10-jupyterlab | 4.6.1-r1 |
| Wolfi | py3.11-jupyterlab | 4.6.1-r1 |
| Wolfi | py3.12-jupyterlab | 4.6.1-r1 |
| Wolfi | py3.13-jupyterlab | 4.6.1-r1 |
| Wolfi | renovate | 43.38.0-r1 |
| Wolfi | saf | 1.6.0-r0 |
| Wolfi | sqlpad | 7.5.7-r10 |
| Wolfi | tileserver-gl | 5.5.0-r5 |
| Wolfi | vitess-23 | 23.0.2-r1 |