CVE-2026-26960 (High) detected in tar-7.5.1.tgz

[mend-bolt-for-github]

CVE-2026-26960 - High Severity Vulnerability

Vulnerable Library - tar-7.5.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-7.5.1.tgz

Path to dependency file: /devel/electron39/files/packagejsons/package.json

Path to vulnerable library: /devel/electron39/files/packagejsons/package.json

Dependency Hierarchy:

• @electron-ci/is-valid-window-0.0.5.tgz (Root Library)
  • nan-2.23.0.tgz
    • node-gyp-11.5.0.tgz
      • ❌ tar-7.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 25cf57a93f385839bd7e68424038ff713426e4e9

Found in base branch: master

Vulnerability Details

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

Publish Date: 2026-02-20

URL: CVE-2026-26960

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-02-18

Fix Resolution: https://github.com/isaacs/node-tar.git - v7.5.8,tar - 7.5.8

---

Step up your Open Source Security Game with Mend here