node-tar is a popular tar implementation for Node.js. A flaw in versions prior to 7.5.11 allows an attacker to craft a tar archive that contains a symlink with a drive‑relative target such as C:../../../target.txt. When the archive is extracted with tar.x(), the symlink points outside the intended extraction directory, permitting the extraction process to overwrite files located anywhere on the same drive. This path traversal vulnerability can thus change, delete, or overwrite arbitrary files, leading to integrity compromise or, if critical system files are targeted, potential privilege escalation.

The affected product is isaacs' node-tar, bundled in Node.js environments. All releases older than 7.5.11 are vulnerable, including 7.5.10 and earlier. Users of Node.js applications that depend on node-tar for archive extraction should verify the installed version and upgrade as soon as possible.

The CVSS score of 8.2 indicates high severity. The EPSS score is below 1%, suggesting that exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. However, the attack path is straightforward: an attacker can supply a malicious tar archive to any process that uses node-tar for extraction, and the vulnerability will allow the attacker to overwrite arbitrary files located on the same drive. Because the symlink requires a drive‑relative target, the risk is mainly for Windows environments; based on the description, this is inferred as the default OS requires drive letters, but non‑Windows users may still be affected if similar path handling occurs. Environment hardening and timely patching are essential.