The node-tar library, used for extracting Tar archives in Node.js environments, does not properly sanitize the linkpath of Link (hardlink) and SymbolicLink entries when the preservePaths option is set to false. This flaw permits a malicious archive to create or overwrite files outside the intended extraction directory, enabling arbitrary file overwrite and symlink poisoning. The vulnerability is a classic path traversal issue (CWE‑22) and can compromise confidentiality, integrity, and availability of the host system if exploited.

Any application incorporating node‑tar version 7.5.2 or earlier on Node.js is affected. The flaw is present in the isaacs:node-tar package, and versions up to and including 7.5.2 lack the necessary path sanitization.

The CVSS score of 8.2 indicates a high severity potential. The EPSS score is listed as less than 1%, suggesting low current exploitation probability, but the flaw is not included in the CISA KEV catalog. Exploitation requires delivery of a crafted tar archive to a vulnerable application. If the application processes untrusted tar files—whether locally by a user or remotely through a web service—the attacker can cause arbitrary file overwrite or symlink poisoning, potentially gaining elevated privileges or disabling services. The attack vector is likely local or remote file upload, depending on how the application ingests archives.