CVE-2026-31802
Fixed in a distro release EPSS <1%CVSS 8.2
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.
Products: isaacs node-tar
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | tar | 7.5.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.332.0-r2 |
| Chainguard | drupal-11.3 | 11.3.13-r3 |
| Chainguard | gemini-cli | 0.49.0-r4 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r31 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r12 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.4-r10 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r8 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.2-r2 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r15 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r61 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.4-r7 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.2-r9 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r4 |
| Chainguard | graalvm-24-ce-nodejs | no fix |
| Chainguard | graalvm-25-ce-nodejs | 25.0.2-r5 |
| Chainguard | jupyter-base-notebook | 7.6.3-r2 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kibana-7 | no fix |
| Chainguard | kibana-8.17 | 8.17.10-r13 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r13 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r13 |
| Chainguard | kibana-8.18 | 8.18.8-r11 |
| Chainguard | kibana-8.18-bitnami | 8.18.8-r11 |
| Chainguard | kibana-8.18-iamguarded | 8.18.8-r11 |
| Chainguard | kibana-9.0 | 9.0.8-r14 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r14 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r14 |
| Chainguard | kibana-9.1 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 9.2.6-r1 |
| Chainguard | kibana-9.2-iamguarded | 9.2.6-r1 |
| Chainguard | kibana-9.3 | 9.3.1-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.1-r1 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r15 |
| Chainguard | lerna | 9.0.7-r1 |
| Chainguard | node-gyp | 12.2.0-r2 |
| Chainguard | opensearch-dashboards-2 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-3-fips | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.5.0-r4 |
| Chainguard | pnpm-stage0 | 8.7.4-r7 |
| Chainguard | pulumi-language-nodejs | 3.224.0-r2 |
| Chainguard | py3.10-jupyterlab | 4.6.1-r1 |
| Chainguard | py3.11-jupyterlab | 4.6.1-r1 |
| Chainguard | py3.12-jupyterlab | 4.6.1-r1 |
| Chainguard | py3.13-jupyterlab | 4.6.1-r1 |
| Chainguard | renovate | 43.77.8-r1 |
| Chainguard | saf | 1.6.0-r0 |
| Chainguard | sqlpad | 7.5.7-r13 |
| Chainguard | tensorflow-cpu-jupyter | 2.21.0-r8 |
| Chainguard | tensorflow-gpu-jupyter | 0 |
| Chainguard | tileserver-gl | 5.5.0-r8 |
| Chainguard | tileserver-gl-fips | 5.5.0-r9 |
| Chainguard | vitess-21 | no fix |
| Chainguard | wazuh-dashboard | 4.14.5-r4 |
| Chainguard | wazuh-dashboard-fips | 4.14.5-r4 |
| Debian 14 | node-tar | 6.2.1+ds1+~cs6.1.13-10 |
| Ubuntu 18.04 LTS | node-tar | no fix |
| Ubuntu 22.04 LTS | node-tar | no fix |
| Ubuntu 24.04 LTS | node-tar | no fix |
| Ubuntu 25.10 | node-tar | no fix |
| Ubuntu 26.04 LTS | node-tar | no fix |
| Ubuntu 26.10 | node-tar | no fix |
| Ubuntu Pro 14.04 LTS | node-tar | no fix |
| Ubuntu Pro 16.04 LTS | node-tar | no fix |
| Ubuntu Pro 20.04 LTS | node-tar | no fix |
| Wolfi | jupyter-base-notebook | 7.6.3-r2 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r15 |
| Wolfi | lerna | 9.0.7-r1 |
| Wolfi | node-gyp | 12.2.0-r2 |
| Wolfi | pnpm-stage0 | 8.7.4-r7 |
| Wolfi | pulumi-language-nodejs | 3.224.0-r2 |
| Wolfi | py3.10-jupyterlab | 4.6.1-r1 |
| Wolfi | py3.11-jupyterlab | 4.6.1-r1 |
| Wolfi | py3.12-jupyterlab | 4.6.1-r1 |
| Wolfi | py3.13-jupyterlab | 4.6.1-r1 |
| Wolfi | renovate | 43.77.8-r1 |
| Wolfi | saf | 1.6.0-r0 |
| Wolfi | sqlpad | 7.5.7-r13 |
| Wolfi | tileserver-gl | 5.5.0-r8 |