The vulnerability in node‑tar versions earlier than 7.5.7 arises from a mismatch between the security check for hardlink entries and the actual hardlink creation logic. This flaw allows a malicious TAR archive to bypass directory traversal protections and create hardlinks to arbitrary files outside the intended extraction directory, thereby enabling the attacker to overwrite or create arbitrary files. The weakness is a classic instance of path traversal (CWE‑22) combined with improper path handling (CWE‑59).

Any Node.js application that incorporates the node‑tar library (isaacs: node‑tar) with a version earlier than 7.5.7 is affected. The fix is delivered in node‑tar 7.5.7 and later, and review the application’s dependency tree for older versions.

The CVSS score of 8.2 indicates a high severity, but the EPSS exposure is below 1%, suggesting that, as of this analysis, the likelihood of exploitation is low. The attack requires an instance of node‑tar to extract a crafted TAR archive, which consequently allows creation of arbitrary hardlinks outside the extraction directory; this can result in corrupting or overwriting files. No CISA KEV entry exists for this CVE, so widespread exploitation has not yet been reported.