Race Condition

🗓️ 02 Feb 2026 08:34:45Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 3 Views

node-tar race condition allows colliding Unicode paths to bypass locks and enable symlink poisoning.

Reporter	Title	Published	Views	Family All 94
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	2 Feb 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-6.2.1.tgz	13 Apr 202613:07	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for April 2026.	5 May 202621:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	27 Mar 202616:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	18 May 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses tar-7.4.3.tgz which is vulnerable to CVE-2026-23745 and CVE-2026-23950.	31 Mar 202613:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	27 Apr 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	31 Mar 202600:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:25	–	ibm

Vulners

Node

node-tar node-tarMatch6.1.11+~cs11.3.10-1debian

AND

node-tar node-tarMatch6.0.5+ds1+~cs11.3.9-1debian

AND

node-tar node-tarMatch6.0.5+ds1-2debian

AND

debian debian_linuxMatch999

tar_project tarMatch7.4.3js

tar_project tarRange7.0.0–7.5.3js

tar_project tarRange0.0.1–7.5.3js

Source	Link
github	www.github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6
github	www.github.com/advisories/GHSA-r6q2-hw4h-h46w
github	www.github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w

20 Jun 2026 07:56Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9 - 8.8

EPSS0.00153

SSVC