CVE-2026-26960: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26960 is a path traversal vulnerability (CWE-22) in the node-tar npm package, formally titled "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction." It affects all versions of node-tar prior to 7.5.8 and allows an attacker-controlled tar archive to read or overwrite files outside the intended extraction directory. The vulnerability was published on February 16, 2026, by the package maintainer (isaacs), and formally added to the NVD on February 20, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause (CWE-22) lies in how node-tar's tar.extract() function performs linkpath safety checks using string-based path comparisons rather than resolving symlinks on disk before creating hardlinks. An attacker crafts a malicious tar archive containing two symlinks and one hardlink in a specific chain: a/b/c/up -> ../.., a/b/escape -> c/up/../.., and a hardlink exfil -> a/b/escape/<target>. Because STRIPABSOLUTEPATH logic in unpack.js does not resolve intermediate symlinks when validating the hardlink target, fs.link() is called with a resolved path that escapes the extraction root. Parent directory safety checks are applied only to the destination path of the extracted entry, not to the resolved hardlink target, allowing the hardlink to be created inside the extraction root while pointing to an external file. A public PoC (hardlink.js) was included in the security advisory and confirmed exploitation on Node v25.4.0 with tar 7.5.7 (GitHub Advisory, Patch Commit).

Successful exploitation enables arbitrary file read and write as the user running the extracting process — no root privileges, chmod, or preservePaths option required. An attacker can exfiltrate sensitive files accessible to the process (e.g., SSH keys, API credentials, configuration files, application data) and overwrite writable files outside the extraction root, potentially leading to code execution if writable scripts or configuration files are targeted. The impact scope is bounded by the privileges of the extracting process, but in cloud-native and CI/CD environments where node-tar is widely used, this can translate to significant lateral movement or supply chain compromise (GitHub Advisory, Feedly).

A public proof-of-concept (hardlink.js) was released alongside the security advisory on February 16, 2026, and is referenced in the NVD entry. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (1st percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — specifically, a user or automated process must extract an attacker-controlled tar archive — and the attack vector is local (GitHub Advisory).

1. Craft malicious tar archive: Create a tar archive containing the following entries in order:
   • A symlink: a/b/c/up -> ../.. (points two directories up from a/b/c/)
   • A symlink: a/b/escape -> c/up/.. (resolves through the first symlink to escape the extraction root)
   • A hardlink: exfil -> a/b/escape/<target-file> (e.g., a/b/escape/secret.key), where <target-file> is a sensitive file outside the extraction directory
2. Deliver the archive: Trick the target application or user into extracting the malicious archive using tar.extract({ file: 'malicious.tar', cwd: '/extraction/dir' }) with default options.
3. Trigger extraction: The node-tar library processes entries sequentially. When it reaches the hardlink entry, it resolves the linkpath string-based (without following symlinks on disk) and calls fs.link(resolvedTarget, destination), creating a hardlink inside the extraction root that shares an inode with the external target file.
4. Read or overwrite the target: Read the exfil file inside the extraction directory to obtain the contents of the external file, or write to exfil to modify the external file. Confirm exploitation by checking same_inode=true, read_ok=true, write_ok=true in the PoC output (GitHub Advisory).

• File System: Unexpected hardlinks inside an extraction directory that share inodes with files outside the extraction root (detectable via stat inode comparison); presence of files named exfil or similarly suspicious names in extraction directories; unexpected modification timestamps on sensitive files (SSH keys, config files, scripts) outside extraction directories.
• Logs: Application logs showing tar.extract() calls processing archives from untrusted or external sources; Node.js process errors referencing TAR_SYMLINK_ERROR or SymlinkError (if strict mode is enabled and the patched version is in use, these errors indicate attempted exploitation).
• Process: Node.js processes performing unexpected file reads or writes to paths outside their designated working directories; unusual file access patterns to credential or configuration files by processes that handle archive extraction.

The primary remediation is to update the node-tar npm package to version 7.5.8 or later, which introduces the ENSURE_NO_SYMLINK check that validates hardlink and symlink targets by resolving intermediate symlinks on disk before allowing link creation (Patch Commit, GitHub Advisory). As a defense-in-depth measure, apply the principle of least privilege to processes that extract tar archives, and validate or reject tar archives from untrusted sources before extraction. Multiple IBM products (API Connect, watsonx Orchestrate, App Connect Enterprise, QRadar Suite, Business Automation Insights, Instana, and others) have published security updates addressing this vulnerability — consult the respective IBM security bulletins for product-specific patch guidance (IBM API Connect, IBM watsonx Orchestrate). Atlassian also addressed this vulnerability in security bulletins published April 21 and May 19, 2026 (Atlassian April 2026, Atlassian May 2026).

The vulnerability was reported by security researcher scumfrog and disclosed responsibly through the node-tar GitHub repository. Atlassian included it in two security bulletins (April and May 2026) covering multiple products, and IBM issued over a dozen security advisories across its product portfolio. Debian issued a security advisory (DLA-4552-1) for node-tar, and Amazon Linux 2023 published a corresponding advisory (ALAS2023-2026-1578). Red Hat addressed it via RHSA-2026:5447. Community coverage appeared on security aggregators including Tenable (Nessus plugin 299677), Qualys, and security blogs such as infinitsec.net and redpacketsecurity.com (Atlassian April 2026, Debian Advisory).