CVE-2026-23745: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23745 is a path traversal vulnerability in the node-tar (npm tar) library affecting all versions up to and including 7.5.2. The flaw allows malicious TAR archives to bypass extraction root restrictions via insufficient sanitization of linkpath fields in hardlink and symlink entries, enabling arbitrary file overwrite and symlink poisoning. It was published on January 16, 2026, and patched in version 7.5.3. The CVSS v4 base score is 8.2 (High) and the CVSS v3.1 base score is 6.1 (Medium) (Github Advisory, node-tar Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It exists in src/unpack.ts within the [HARDLINK] and [SYMLINK] methods. For hardlinks, the extraction logic uses path.resolve(this.cwd, entry.linkpath) to determine the target; when entry.linkpath is an absolute path, Node.js's path.resolve ignores this.cwd entirely, allowing the hardlink to point outside the extraction root. For symlinks, entry.linkpath is passed directly to fs.symlink without validation, permitting creation of symlinks pointing to arbitrary absolute paths (e.g., /etc/passwd) or traversal paths (../../). Both attack vectors function even when preservePaths: false (the default secure setting) is used. A public PoC script was included in the advisory itself, demonstrating both hardlink overwrite and symlink poisoning (node-tar Advisory, Patch Commit).

Successful exploitation allows an attacker to overwrite any file that the tar extraction process has write access to, bypassing path-based security restrictions — though it does not grant access beyond the process's existing permissions. In CI/CD pipelines or automated build environments, this can escalate to remote code execution by overwriting configuration files, scripts, or binaries with malicious content. Confidentiality is also impacted, as symlink poisoning can redirect reads to sensitive files. npm itself is unaffected because it filters out all Link and SymbolicLink tar entries from extracted packages (Github Advisory).

A public proof-of-concept exploit was published on GitHub (by reporter Jvr2022) at the time of disclosure and is included verbatim in the official security advisory (node-tar Advisory, PoC GitHub). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.011% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — a user or automated process must extract a maliciously crafted archive (Github Advisory).

1. Craft a malicious TAR archive: Using Node.js and the tar library, create a TAR file with two malicious entries: a Link (hardlink) entry whose linkpath is set to an absolute path of a target file (e.g., /home/user/secret.txt), and a SymbolicLink entry whose linkpath points to a sensitive absolute path (e.g., /etc/passwd).
2. Deliver the archive: Distribute the malicious .tar file to a target system where node-tar <= 7.5.2 is used for extraction — for example, by submitting it as a package, upload, or artifact in a CI/CD pipeline that automatically extracts archives.
3. Trigger extraction: Cause the target system to extract the archive using tar.x() with default settings (preservePaths: false). The vulnerable [HARDLINK] method resolves the absolute linkpath outside the extraction root, and [SYMLINK] creates a symlink pointing to the attacker-specified absolute path.
4. Achieve file overwrite or RCE: Write to the hardlinked file within the extraction directory — this write propagates to the original target file outside the extraction root. In CI/CD environments, overwrite a script or binary that is subsequently executed, achieving code execution (node-tar Advisory, Github Advisory).

• File System: Unexpected hardlinks or symlinks within a tar extraction directory pointing to paths outside the extraction root (e.g., /etc/passwd, /home/user/ paths); files outside the extraction directory with unexpectedly modified timestamps or content.
• File System: Presence of a suspicious .tar file containing Link or SymbolicLink entries with absolute linkpath values (detectable via tar -tvf <file>).
• Logs: Node.js process logs or application logs emitting TAR_ENTRY_INFO warnings about "stripping root from absolute linkpath" — in patched versions this is a warning; in vulnerable versions, no warning is emitted and the path is used as-is.
• Process: Unexpected process execution spawned from a CI/CD pipeline or build system following a tar extraction step, particularly if scripts or binaries in the pipeline were recently modified.
• Network: In CI/CD contexts, unexpected outbound connections from build agents following a package extraction step may indicate post-exploitation activity (node-tar Advisory).

Upgrade node-tar (npm package tar) to version 7.5.3 or later, which introduces the [STRIPABSOLUTEPATH] method that properly sanitizes both path and linkpath fields for all entry types (Patch Commit). As a workaround prior to patching, use a filter function in tar.x() options to reject all entries of type Link and SymbolicLink. IBM has released security updates for affected products including Cloud Pak for Business Automation, App Connect Enterprise, Data Virtualization, API Connect, and watsonx components — consult the relevant IBM security bulletins for specific fix versions (Github Advisory). Additionally, sandbox tar extraction operations with minimal required permissions to limit the blast radius of any exploitation.

The vulnerability was reported by researcher Jvr2022 and disclosed via GitHub Security Advisories on January 16, 2026. IBM issued multiple security bulletins across its product portfolio (API Connect, Cloud Pak for Automation, watsonx products, App Connect Enterprise, and others) acknowledging the impact and providing patches. Atlassian also referenced the vulnerability in its April 2026 security bulletin (Atlassian Bulletin). Community discussion appeared on Bluesky and security aggregator sites, and Debian issued a LTS security announcement (DLA-4552-1) for the node-tar package. Coverage was also noted in Cyble's weekly vulnerability roundup.