CVE-2026-29786: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29786 is a hardlink path traversal vulnerability in the node-tar npm package (also known as tar) that allows an attacker to craft a malicious tar archive containing a drive-relative hardlink target (e.g., C:../target.txt), causing files to be written outside the intended extraction directory during a normal tar.x() extraction. It affects all versions of node-tar up to and including 7.5.9, and was patched in version 7.5.10. The vulnerability was published on March 7, 2026, with the fix committed on March 11, 2026. It carries a CVSS v3.1 score of 6.3 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause lies in a logic ordering flaw in the Unpack class within src/unpack.ts (CWE-22: Path Traversal; CWE-59: Improper Link Resolution Before File Access). The extraction code checked for .. path segments before stripping the drive-relative root prefix. When a hardlink entry has a linkpath of C:../target.txt, splitting on / yields ['C:..', 'target.txt'] — so parts.includes('..') evaluates to false, bypassing the traversal check. Subsequently, stripAbsolutePath() removes the C: prefix, leaving ../target.txt as the resolved hardlink target, which points one directory above the extraction cwd. The fix (commit 7bc755d) reorders the logic to strip the drive root before checking for .. segments (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files outside the intended extraction directory with the permissions of the process performing the extraction. This creates an arbitrary file write primitive that can be escalated to code execution in realistic scenarios — such as CLI tools unpacking untrusted tarballs, build/update pipelines consuming third-party archives, or services that import user-supplied tar files. There is no direct confidentiality impact, but integrity of the host filesystem is severely affected, and availability may be impacted if critical system files are overwritten (GitHub Advisory).

Multiple high-confidence proof-of-concept exploits are publicly available. A standalone PoC script (poc.cjs) was published in the official GitHub Security Advisory and demonstrates the full exploit chain — creating a malicious tar archive and confirming file overwrite outside the extraction directory. A separate PoC repository (Jvr2022/CVE-2026-29786) also provides a runnable JavaScript exploit. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.019% (0.000190), indicating low current exploitation probability (Feedly).

1. Craft a malicious tar archive: Create a tar file containing a hardlink entry with a drive-relative linkpath such as C:../target.txt. Using the tar npm package's Header API:

const b = Buffer.alloc(1536);
new Header({ path: 'l', type: 'Link', linkpath: 'C:../target.txt' }).encode(b, 0);
fs.writeFileSync('poc.tar', b);

2. Deliver the archive to the target: Supply the malicious tar file to any system or pipeline that uses a vulnerable version of node-tar (≤ 7.5.9) to extract user-supplied or third-party archives.
3. Trigger extraction: The victim system calls tar.x({ cwd, file: 'poc.tar' }). The traversal check fails to detect .. in C:../target.txt, and stripAbsolutePath() resolves the hardlink to ../target.txt relative to cwd.
4. Overwrite target file: After extraction, writing to the extracted hardlink entry (e.g., path.join(cwd, 'l')) overwrites the file at ../target.txt — outside the extraction directory — with attacker-controlled content.
5. Escalate to code execution: Overwrite a sensitive file such as a startup script, configuration file, or executable to achieve persistent code execution with the privileges of the extraction process (GitHub Advisory, GitHub Commit).

• File System: Unexpected files created or modified outside the designated tar extraction directory; files with a hardlink count greater than 1 in or near the extraction directory pointing to locations outside it; newly created or modified startup scripts, configuration files, or executables in parent directories of extraction paths.
• Logs: Node.js process logs showing tar.x() calls on externally sourced or user-supplied archive files; filesystem audit logs (e.g., auditd) recording write operations to paths outside the expected extraction cwd by the Node.js process.
• Process: Unexpected child processes spawned by a Node.js application shortly after a tar extraction event, particularly shells or interpreters; unusual file write activity from the Node.js process to directories above the application working directory.

The primary remediation is to upgrade node-tar (npm package tar) to version 7.5.10 or later, which reorders the path sanitization logic to strip drive-relative roots before checking for .. segments (GitHub Advisory, GitHub Commit). If immediate upgrade is not possible, validate tar archive contents before extraction (reject entries with drive-relative or absolute link targets), restrict filesystem write permissions for the extraction process, and consider extracting archives in isolated environments (e.g., containers with limited filesystem scope). IBM has released patches for affected products including IBM API Connect, IBM App Connect Enterprise, IBM watsonx Orchestrate, IBM Business Automation Insights, and others (IBM Advisory).

IBM issued multiple security bulletins addressing CVE-2026-29786 across a broad range of products including API Connect, App Connect Enterprise, watsonx Orchestrate, watsonx BI Assistant, DevOps Solution Workbench, Business Automation Insights, and IBM Bob (IBM Advisory). Atlassian also referenced the vulnerability in its May 19, 2026 security bulletin covering Bamboo, Confluence, and Jira products (Atlassian Bulletin). Debian issued a LTS security announcement (DLA-4552-1) for the node-tar package, and Amazon Linux 2023 published a corresponding advisory (ALAS2023-2026-1609). Detection plugins were released by Tenable (Nessus) and Qualys, indicating broad scanner coverage.