https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:25:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-23745 <p><strong>Affected:</strong> isaacs node-tar, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat Migration Toolkit 1.8, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Dev Spaces 3.27, Red Hat Trusted Artifact Signer 1.2, Red Hat Trusted Artifact Signer 1.3 and 32 more</p> <p>node-tar is a Tar for Node.js. The node-tar library (&lt;= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.</p> <p><strong>Affected:</strong> isaacs node-tar, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat Migration Toolkit 1.8, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Dev Spaces 3.27, Red Hat Trusted Artifact Signer 1.2, Red Hat Trusted Artifact Signer 1.3 and 32 more</p> <p>node-tar is a Tar for Node.js. The node-tar library (&lt;= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-23745