CVE-2026-24842: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24842 is a path traversal vulnerability in node-tar (the tar npm package for Node.js) that allows an attacker to craft a malicious TAR archive which bypasses hardlink path traversal protections and creates hardlinks to arbitrary files outside the intended extraction directory. It affects all versions of node-tar prior to 7.5.7. The vulnerability was published on January 27–28, 2026, and credited to researcher mistersiddd. It carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, node-tar Advisory).

The root cause is a semantic mismatch between two code paths in lib/unpack.js (CWE-22, CWE-59): the security check for hardlink entries resolves the linkpath relative to the entry's parent directory using path.posix.normalize(path.posix.join(entryDir, linkpath)), while the actual hardlink creation resolves it relative to the extraction cwd using path.resolve(this.cwd, entry.linkpath). Because these two starting points differ, a deeply nested entry (e.g., a/b/c/d/x) with a linkpath like ../../../../etc/passwd passes the security check (resolves to etc/passwd, no leading ../) but escapes the extraction directory during actual hardlink creation (resolves to /etc/passwd). The deeper the entry path nesting, the more directory levels an attacker can traverse. A full proof-of-concept is publicly available in the GitHub Security Advisory (node-tar Advisory, Patch Commit).

Exploitation enables two primary attack classes: a read attack, where if the application serves extracted files, an attacker can read any file accessible to the Node.js process (e.g., credentials, .env files, SSH keys); and a write attack, where if the application subsequently writes to the hardlinked path, it overwrites the target file outside the extraction directory. Chained write attacks can achieve remote code execution by overwriting application source files, cron jobs, SSH authorized_keys, or systemd service files. The scope is marked as Changed in CVSS, reflecting that the impact extends beyond the extraction directory to the broader filesystem. Numerous IBM enterprise products (Cloud Pak for Automation, API Connect, Watsonx platforms, App Connect Enterprise, Instana, and others) are also affected as downstream consumers of node-tar (Github Advisory, IBM Instana Advisory).

A working proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating both read and write attack scenarios with a crafted TAR archive and a simple Node.js HTTP server (node-tar Advisory). Exploitation requires user interaction in the sense that a victim application must extract the malicious archive, but no privileges are required from the attacker. The EPSS score is approximately 0.027% (0.000270), indicating a currently low probability of active exploitation. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (Github Advisory).

1. Craft malicious TAR archive: Using a script (e.g., Node.js), construct a TAR archive containing a deeply nested directory entry (e.g., a/b/c/d/) and a hardlink entry (e.g., a/b/c/d/x) whose linkpath uses enough ../ sequences to escape the extraction directory when resolved from cwd (e.g., ../../../../etc/passwd), but passes the security check when resolved from the entry's parent directory.
2. Deliver the archive: Upload or otherwise deliver the malicious .tar file to a target application that accepts user-supplied archives and extracts them using a vulnerable version of node-tar (< 7.5.7).
3. Trigger extraction: Cause the application to extract the archive (e.g., via an HTTP upload endpoint). During extraction, node-tar's security check passes the crafted linkpath, but the actual fs.linkSync() call creates a hardlink pointing to the target file outside the extraction directory (e.g., /etc/passwd).
4. Read attack: If the application serves extracted files, request the hardlinked file path (e.g., GET /read in the PoC server) to retrieve the contents of the sensitive target file.
5. Write attack (optional RCE): If the application writes to extracted files (e.g., config update, log append), send a write request targeting the hardlinked path. The write operation modifies the actual target file (e.g., overwriting ~/.ssh/authorized_keys with an attacker-controlled public key, or overwriting an application .js file with a backdoor for immediate RCE) (node-tar Advisory, Patch Commit).

• File System: Unexpected hardlinks in the extraction directory pointing to files outside it (detectable via find <extraction_dir> -type f and checking inode numbers against sensitive system files); unexpected modification timestamps on files like ~/.ssh/authorized_keys, /etc/passwd, /etc/cron.d/*, or application source files.
• File System: New or modified files in sensitive locations (e.g., SSH keys, cron jobs, systemd service files, application .js/.py/.php files) with modification times correlating to archive extraction events.
• Logs: Application logs showing TAR extraction of archives containing deeply nested directory structures followed by unexpected file access or write operations outside the upload/extraction directory.
• Network: Inbound HTTP requests uploading .tar files to file upload endpoints, followed shortly by outbound connections (potential reverse shell) or unusual data exfiltration from the server process.
• Process: Node.js process spawning unexpected child processes (e.g., bash, sh, curl, wget) after a TAR extraction event, which may indicate successful RCE via overwritten application files (node-tar Advisory).

The primary remediation is to upgrade the tar npm package to version 7.5.7 or later, which fixes the issue by applying the same strict .. rejection logic to hardlink entries as is applied to regular file paths — rejecting any hardlink linkpath containing .. (Patch Commit, Github Advisory). No configuration-based workaround is available; the only mitigation is patching. For IBM products affected as downstream consumers (Cloud Pak for Automation, API Connect, Watsonx platforms, App Connect Enterprise, Instana, etc.), apply the corresponding IBM security iFixes referenced in the respective IBM support advisories (IBM Instana Advisory, IBM API Connect). Organizations should also audit any application that accepts user-supplied TAR archives and extracts them server-side, and consider validating archive contents before extraction as a defense-in-depth measure.

The vulnerability received coverage from security news aggregators including The Hacker Wire and was discussed on Mastodon and Bluesky shortly after disclosure. The pnpm package manager addressed the issue in its v10.29 release. The OpenAI Codex project also patched the dependency in its Rust v0.105.0 release. Debian issued a Long Term Support (LTS) security announcement (DLA-4552-1) for node-tar, and Red Hat issued RHSA-2026:5447. The AWS Lambda base images team was also notified via a GitHub issue. Overall community reaction focused on the practical RCE potential of the write attack vector and the breadth of downstream IBM enterprise product impact (Github Advisory, Atlassian Bulletin).