CVE-2026-26960

🗓️ 20 Feb 2026 01:07:52Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 76 Views

node-tar up to 7.5.7 allows arbitrary file read/write via hardlink escape during extraction; fixed in 7.5.8.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-7.5.7.tgz	28 Apr 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	2 Jun 202614:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	10 Jun 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage	9 Jul 202622:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	31 Mar 202615:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.7.tgz which is vulnerable to CVE-2026-26960	5 May 202609:38	–	ibm
ATTACKERKB	CVE-2026-26960	20 Feb 202601:07	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1483)	30 Mar 202600:00	–	nessus

NVD

Vulners

Node

isaacs tarRange<7.5.8node.js

[
  {
    "vendor": "isaacs",
    "product": "node-tar",
    "versions": [
      {
        "version": "< 7.5.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
github	www.github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384
github	www.github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f

17 Jun 2026 10:26Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.1

EPSS0.00288

SSVC

CWE-22