This vulnerability in node-tar allows an attacker who can supply a crafted archive to create a hardlink within the extraction directory that points to a file outside the extraction root, permitting arbitrary reading and writing of files as the extracting user. The flaw bypasses the library’s path validation, turning normal archive extraction into a direct filesystem access primitive. Consequently, the attacker could gain read or write access to any file on the filesystem that the extracting process can read or write, potentially compromising confidentiality, integrity, or system stability. Based on the description, it is inferred that the attack could be remote if the extraction routine is invoked in a service that accepts user-supplied archives.

The issue affects the node-tar package developed by isaacs and distributed via npm. Versions 7.5.7 and earlier are vulnerable; the problem was fixed in version 7.5.8 and later. All Node.js applications that use node-tar to extract tar archives and rely on default options are potentially impacted.

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and there is no current listing in the CISA KEV catalog. The attack vector requires the attacker to provide a malicious archive to the extraction routine—so it is a local or potentially remote threat if extraction occurs in a service that accepts user-supplied archives. Based on the description, it is inferred that the exploit may be possible in remote contexts where the extraction routine is exposed to untrusted input.