CVE-2026-31802

CVE-2026-31802: tar シンボリックリンクのパストラバーサル / 任意ファイル上書き 研究: Joshua van Rijswijk 説明 このリポジトリには、npm の tar パッケージ（node-tar）のバージョン = 7.5.10 に影響する高深刻度の脆弱性 CVE-2026-31802 に関する、私の概念実証と解説が含まれています。 tar は、C:../../../target.txt のようなドライブ相対...

CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar npm can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x...

AZL-79553 CVE-2026-29786 affecting package tar 1.35-2

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...

CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...