CVE-2026-31802: node-tar Symlink Path Traversal via Drive-Relative Linkpath

March 10, 2026

tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction.

References

github.com/advisories/GHSA-9ppj-qmqm-q256
github.com/isaacs/node-tar
github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad
github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256
nvd.nist.gov/vuln/detail/CVE-2026-31802

Code Behaviors & Features

Detect and mitigate CVE-2026-31802 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →