The vulnerability of the node-tar library in the Node.js software platform arises from incorrect path name restrictions for restricted-access directories. This allows attackers to gain unauthorized access to protected information.

🗓️ 25 May 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 14 Views

The node-tar library has path restrictions on restricted directories, enabling unauthorized access.

Reporter	Title	Published	Views	Family All 314
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-7.5.7.tgz	28 Apr 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	2 Jun 202614:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	10 Jun 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage	9 Jul 202622:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	31 Mar 202615:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	22 Sep 202604:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.7.tgz which is vulnerable to CVE-2026-26960	5 May 202609:38	–	ibm
attackerkb	CVE-2026-26960	20 Feb 202601:07	–	attackerkb

Vulners

Node

OR

red_hat,red_hat_openshift_dataMatch4

red_hat,red_hat_trusted_artifact_signerMatch1.3

node.js node-tarRange<7.5.13

red_hat,red_hat_openshift_dev_spacesMatch3.27

red_hat,network_observabilityMatch1.11.2

Source	Link
github	www.github.com/isaacs/node-tar
github	www.github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384
github	www.github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f
github	www.github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
redos	www.redos.red-soft.ru/search/
access	www.access.redhat.com/security/cve/cve-2026-26960
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-26960
web	www.web.nvd.nist.gov/view/vuln/detail

25 May 2026 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 26.6

CVSS 37.1

EPSS0.00202

node tar library path restrictions restricted directories unauthorized access protected information