CVE-2026-23745

CVE-2026-23745 affects the node-tar library (versions <= 7.5.2), a Node.js module for handling Tar archives. The vulnerability stems from insufficient sanitization of linkpaths in hardlink and symbolic link entries when the preservePaths option is disabled, allowing malicious archives to bypass extraction root restrictions. This can lead to arbitrary file overwrite through hardlinks and symlink poisoning via absolute symlink targets. Rated as MEDIUM severity with a CVSS score of 6.1, the vulnerability requires user interaction (UI:R) and local access (AV:L) for exploitation, with low attack complexity (AC:L). Successful exploitation could result in high confidentiality impact (C:H) and low integrity impact (I:L), but no availability impact (A:N). Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. While there have been two community mentions on GitHub regarding fixes, the CVE has not garnered significant media attention.