jvr2022/cve-2026-29786Proof-of-concept demonstrating a hardlink path traversal in the tar npm package, allowing overwrite of files outside the extraction directory via crafted archives.
Research: Joshua van Rijswijk
This repository contains a Proof of Concept (PoC) for CVE-2026-29786, a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory.
The issue occurs when a tar archive contains a drive-relative link target such as C:../target.txt. Because of the order in which the library performs validation and path normalization during extraction, the traversal protection can be bypassed.
After normalization, the path becomes ../target.txt, allowing the link target to escape the configured extraction directory.
When the extracted file is written to, the external file is modified because both paths reference the same hardlink.
The vulnerability occurs in the extraction logic responsible for handling absolute paths (Unpack[STRIPABSOLUTEPATH]).
Traversal detection is performed absolute path stripping.
Example malicious header value
linkpath: C:../target.txt
Processing behavior:
The path is split into segments for traversal detection.
The traversal check looks for ".." segments.
Because the segment appears as "C:..", the check does not trigger.
The function stripAbsolutePath() later removes the drive prefix (C:).
The resulting path becomes:
../target.txt
This allows the path to escape the intended extraction root.
An attacker can overwrite files outside the extraction directory with the privileges of the process performing the extraction.
Potential real-world scenarios include:
• CLI tools extracting untrusted tar archives • build pipelines processing third-party artifacts • services importing user-supplied tar files • package managers or plugin systems unpacking archives
npm install [email protected]
node poc.cjs
The script generates a malicious tar archive and demonstrates that writing to the extracted file results in a file outside the extraction directory being overwritten.
