Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-26960

27
FAUCET Score

CVE-2026-26960 is a high-severity vulnerability in node-tar versions 7.5.7 and below, allowing an attacker to create hardlinks outside the extraction directory during archive processing. This enables arbitrary file read and write capabilities, effectively turning archive extraction into a direct filesystem access primitive. The vulnerability has a CVSS score of 7.1 (High) due to its low attack complexity and high impact on confidentiality and integrity. While there is no evidence of active exploitation or public exploit code, the issue has generated some community discussion, and a fix is available in version 7.5.8.

Impacted Technologies

VendorProductVersion(s)CPE
< 7.5.8CPE matchmatch criteria
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.8
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.29%
Probability of exploitation in next 30 days
EPSS Percentile
21.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0029 is in the 19th percentile among its peer group of 11,621 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (40)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: tarFixed in: 7.5.8
redhatno patchvia redhat_api
Product: Cryostat 4Fixed in: io.cryostat-cryostat
redhatno patchvia redhat_api
Product: Network Observability OperatorFixed in: network-observability/network-observability-console-plugin-rhel9
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp20/system
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp21/system
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp22/system
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp24/system
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp25/system
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp26/system
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp2/system-rhel7
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp2/system-rhel8
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp2/system-rhel9
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/volsync-rhel9
redhatno patchvia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: org.jolokia-jolokia-parent
redhatno patchvia redhat_api
Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: io.hawt-project
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: nodejs22
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: tar
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: linux-sgx
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: nodejs:20/nodejs
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: nodejs:22/nodejs
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: polkit
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: tar
redhatno patchvia redhat_api
Product: Red Hat Fuse 7Fixed in: io.hawt-project
redhatno patchvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: io.hawt-project
redhatno patchvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: io.hawt-project
redhatno patchvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: io.hawt-project
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-notebook-controller-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: rhcos
redhatno patchvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/mcg-core-rhel9
redhatno patchvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-console-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/code-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/dashboard-rhel9
redhatno patchvia redhat_api
Product: Red Hat Process Automation 7Fixed in: org.uberfire-uberfire-parent
redhatno patchvia redhat_api
Product: Red Hat Single Sign-On 7Fixed in: org.keycloak-keycloak-parent
redhatno patchvia redhat_api
Product: Red Hat Trusted Artifact SignerFixed in: rhtas/rekor-search-ui-rhel9
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: tar
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: linux-sgx
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/kibana6-rhel8

Vendor Advisories (3)

redhatCVE-2026-26960Moderate

tar: node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation

Feb 20, 2026
npmGHSA-83g3-92jg-28cxhigh

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

Feb 18, 2026
microsoft2026-Feb/CVE-2026-26960Important

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

Feb 10, 2026

References

github.com / isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384
Patch
github.com / isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f
Patch
github.com / isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
ExploitVendor Advisory