CVE-2026-29786

CVE-2026-29786 Investigación: Joshua van Rijswijk Descripción Este repositorio contiene una Prueba de Concepto PoC para CVE-2026-29786 , una vulnerabilidad en el paquete npm tar que permite que un archivo manipulado cree un enlace duro hardlink que apunta fuera del directorio de extracción...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +891 more potentially affected by CVE-2026-53655 via tar (>=7.0.0, <=7.5.15)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-53655 Source advisory: SNYK:JS-TAR-17342362...

37fis (>=1.0.0, <=1.0.2), 88slot-ap (1.0.0) +950 more potentially affected by CVE-2021-37701 via tar (>=3.0.0, <=4.4.15)

tar NPM version =3.0.0, =1.0.0, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.1.0 - @adobe/commerce-cif-magento-graphql 1.0.0 and more Source cves: CVE-2021-37701 Source advisory: OSV:GHSA-9R2W-394V-53QC...

@adaptable/client (>=0.0.9, <=1.26.0), @adaptable/cloud (>=0.0.1, <=1.28.0) +407 more potentially affected by CVE-2021-37701 via tar (>=6.0.0, <=6.1.6)

tar NPM version =6.0.0, =0.0.9, =0.0.1, =1.6.0, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.1.0, =0.6.5, =1.1.0, =1.0.0, =0.0.2, =0.1.0, =0.1.8 and more Source cves: CVE-2021-37701 Source advisory: OSV:GHSA-9R2W-394V-53QC...

@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-37713 via tar (>=5.0.2, <=5.0.7)

tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-37713 Source advisory:...