# CVE-2026-26960

## Summary

- **CVE ID:** CVE-2026-26960
- **Severity:** HIGH
- **CVSS Score:** 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- **CWE:** CWE-22
- **Published:** Feb 20, 2026
- **Last Modified:** Sep 14, 2026

## Description

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

## Affected Products

- isaacs — node-tar (< 7.5.8)
- npm — tar (< 7.5.8)

## References

- [CNA](https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx)
- [CNA](https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384)
- [CNA](https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f)
- [GitHub](https://github.com/advisories/GHSA-83g3-92jg-28cx)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.29%
- **EPSS Percentile:** 21.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._