9 matches found
CVE-2026-29786
CVE-2026-29786 研究： Joshua van Rijswijk 描述 本仓库包含 CVE-2026-29786 的 概念验证（PoC） ，这是 tar npm 包中的一个漏洞，允许特制的归档文件创建指向预期解压目录之外的硬链接 。 当 tar 归档文件包含驱动器相对链接目标 （如 C:../target.txt）时，就会出现此问题。由于库在解压过程中执行验证和路径规范化的顺序问题，遍历保护可以被绕过。 规范化后，路径变为 ../target.txt，从而允许链接目标逃逸出配置的解压目录。 当写入解压后的文件时，外部文件会被修改，因为两个路径引用的是同一个硬链接。 漏洞详情...
Node.js Module node-tar < 7.5.10 Arbitrary File Overwrite
The version of node-tar installed on the remote host is prior to 7.5.10. It is, therefore, affected by a vulnerability: - node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a...
CVE-2026-31802
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar npm can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x...
CVE-2026-29786
A flaw was found in node-tar. A hardlink that points outside the extraction directory can be created by using a drive-relative link target such as C:../target.txt, allowing a file overwrite outside the current working directory during normal tar.x extraction. Mitigation Red Hat has investigated...
DEBIAN-CVE-2026-29786
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...
AZL-79556 CVE-2026-29786 affecting package tar 1.34-3
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...
CVE-2026-29786
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...
CVE-2026-29786
CVE-2026-29786 — node-tar hardlink path-traversal Affected: node-tar (Node.js tar handling) prior to version 7.5.10. Summary: tar can be tricked into creating a hardlink outside the extraction directory by using a drive-relative link target (e.g., C:../target.txt), enabling file overwrite outside...
