rohitberiwala/nodejs-tar-symlink-exploit-cve-2026-29786Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package (CVE-2026-29786)
-yellow){kind=icon}
This repository documents research into CVE-2026-29786, a high-severity vulnerability discovered in the popular Node.js tar package. The flaw allows an attacker to create a malicious tar archive that, when extracted, uses symlinks to overwrite files outside the intended extraction directory (Path Traversal).
The vulnerability exists in how the tar extraction engine validates file paths. By crafting a header with a type: 'symlink', an attacker can point a link to a sensitive location (e.g., /etc/shadow or application config files) and subsequently overwrite it during the extraction process.
The research includes a functional script poc.cjs to demonstrate the vulnerability in a controlled environment.
tar package:
npm install [email protected]
To reproduce the research, you must install the specific vulnerable version of the package:
node poc.cjs