CVE-2026-31802: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31802 is a symlink path traversal vulnerability in node-tar (the tar npm package) that allows an attacker to create a symlink pointing outside the intended extraction directory by embedding a drive-relative symlink target (e.g., C:../../../target.txt) in a crafted tar archive. This enables arbitrary file overwrite outside the current working directory during normal tar.x() extraction. All versions up to and including 7.5.10 are affected; the vulnerability is fixed in version 7.5.11. It was disclosed on March 9, 2026, with a CVSS v4.0 base score of 8.2 (High) and a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, node-tar Advisory).

The root cause (CWE-22: Path Traversal) lies in the Unpack[STRIPABSOLUTEPATH] extraction logic in src/unpack.ts. When processing a symlink entry with a drive-relative linkpath such as C:../../../target.txt, the function stripAbsolutePath() first removes the drive prefix (C:) and rewrites the stored value to ../../../target.txt. However, the escape-boundary check resolves the path using the original pre-stripped value, causing it to be incorrectly treated as in-bounds and accepted. Symlink creation then uses the rewritten traversal path, resulting in a symlink that points outside the extraction root. The fix (commit f48b5fa) corrects the escape check to use the already-stripped path parts rather than the original value, ensuring the boundary validation is applied to the actual symlink target (node-tar Advisory, Fix Commit).

Successful exploitation provides an arbitrary file overwrite primitive outside the intended extraction root, operating with the permissions of the process performing the extraction. This primarily affects integrity — an attacker can overwrite configuration files, scripts, or binaries accessible to the extracting process, potentially enabling privilege escalation or persistent code execution in subsequent system operations. Confidentiality and availability are not directly impacted by the vulnerability itself, but overwriting critical files could lead to service disruption or further compromise. Affected scenarios include CLI tools unpacking untrusted tarballs, build/update pipelines consuming third-party archives, and services that import user-supplied tar files (Github Advisory).

A public proof-of-concept (PoC) script is available in the official security advisory and has been independently reproduced on GitHub (e.g., https://github.com/Jvr2022/CVE-2026-31802). The PoC demonstrates symlink creation outside the extraction directory but requires a separate fs.writeFileSync call to complete the file overwrite, meaning it does not achieve full autonomous exploitation. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.009% (1st percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Craft a malicious tar archive: Create a tar file containing a symbolic link entry with a drive-relative linkpath such as C:../../../target.txt nested under a subdirectory (e.g., a/b/l). This can be done programmatically using the tar npm package's Header class:

const { Header } = require('tar');
const b = Buffer.alloc(1536);
new Header({ path: 'a/b/l', type: 'SymbolicLink', linkpath: 'C:../../../target.txt' }).encode(b, 0);
require('fs').writeFileSync('poc.tar', b);

2. Deliver the archive to the target: Supply the crafted tar file to any system or application that uses the vulnerable tar npm package (versions ≤ 7.5.10) to extract archives — e.g., a build pipeline, CLI tool, or file upload service.
3. Trigger extraction: Cause the target application to call tar.x({ cwd, file: 'poc.tar' }). The flawed escape check accepts the drive-relative path as in-bounds, and the symlink a/b/l -> ../../../target.txt is created outside the extraction directory.
4. Write through the symlink: After extraction, any write operation to the symlink path (e.g., fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\n')) will overwrite the target file outside the extraction root with the permissions of the extracting process (node-tar Advisory).

• File System: Presence of symbolic links within an extraction directory that resolve to paths outside the extraction root (detectable via readlink -f or ls -l); unexpected modification timestamps on files outside the extraction directory coinciding with tar extraction events.
• File System: Newly created or modified files in parent directories of the extraction path (e.g., ../target.txt) with content inconsistent with normal application behavior.
• Logs: Application or build pipeline logs showing tar extraction of archives from untrusted or external sources; Node.js process logs with TAR_ENTRY_ERROR messages such as linkpath escapes extraction directory (emitted by patched versions, absence may indicate unpatched version in use).
• Process: Node.js processes performing file write operations to paths outside their designated working directory immediately following tar extraction; unexpected file modifications by the service account running the Node.js application (node-tar Advisory).

Update the tar npm package to version 7.5.11 or later, which contains the fix for this vulnerability. No configuration-based workaround is available; the only effective remediation is upgrading the package. As a defense-in-depth measure, validate and restrict tar archive sources to trusted origins only, and run extraction processes with the minimum necessary filesystem permissions to limit the blast radius of any successful exploitation. Multiple downstream IBM products (API Connect, App Connect Enterprise, watsonx BI Assistant, DevOps Solution Workbench, Business Automation Insights, and others) have also released security bulletins addressing this issue (node-tar Advisory, Fix Commit, IBM API Connect).

The vulnerability was reported by researcher Jvr2022 and promptly addressed by the node-tar maintainer (isaacs) with a patch released the same day as disclosure (March 9, 2026). Atlassian included this CVE in their April 21, 2026 and May 19, 2026 security bulletins, indicating broad downstream impact across enterprise software ecosystems. Multiple IBM product teams issued security advisories addressing the vulnerability in their products throughout April–June 2026. Debian also issued a security update (DLA-4552-1) for node-tar in late April 2026 (Atlassian April Bulletin, Atlassian May Bulletin, Debian LTS).