chore(deps): update dependency tar to v7.5.10 [security]

[renovate-maintainx]

This PR contains the following updates:

Package	Type	Update	Change	Age
tar	resolutions	patch	7.5.7 -> 7.5.10

GitHub Vulnerability Alerts

CVE-2026-26960

Summary

tar.extract() in Node tar allows an attacker-controlled archive to create a hardlink inside the extraction directory that points to a file outside the extraction root, using default options.

This enables arbitrary file read and write as the extracting user (no root, no chmod, no preservePaths).

Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive.

Details

The bypass chain uses two symlinks plus one hardlink:

1. a/b/c/up -> ../..
2. a/b/escape -> c/up/../..
3. exfil (hardlink) -> a/b/escape/<target-relative-to-parent-of-extract>

Why this works:

• Linkpath checks are string-based and do not resolve symlinks on disk for hardlink target safety.

  • See STRIPABSOLUTEPATH logic in:
    • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:255
    • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:268
    • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:281

• Hardlink extraction resolves target as path.resolve(cwd, entry.linkpath) and then calls fs.link(target, destination).

  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:566
  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:567
  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:703

• Parent directory safety checks (mkdir + symlink detection) are applied to the destination path of the extracted entry, not to the resolved hardlink target path.

  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:617
  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:619
  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/mkdir.js:27
  • ../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/mkdir.js:101

As a result, exfil is created inside extraction root but linked to an external file. The PoC confirms shared inode and successful read+write via exfil.

PoC

hardlink.js
Environment used for validation:

• Node: v25.4.0
• tar: 7.5.7
• OS: macOS Darwin 25.2.0
• Extract options: defaults (tar.extract({ file, cwd }))

Steps:

1. Prepare/locate a tar module. If require('tar') is not available locally, set TAR_MODULE to an absolute path to a tar package directory.

2. Run:

TAR_MODULE="$(cd '../tar-audit-setuid - CVE/node_modules/tar' && pwd)" node hardlink.js

3. Expected vulnerable output (key lines):

same_inode=true
read_ok=true
write_ok=true
result=VULNERABLE

Interpretation:

• same_inode=true: extracted exfil and external secret are the same file object.
• read_ok=true: reading exfil leaks external content.
• write_ok=true: writing exfil modifies external file.

Impact

Vulnerability type:

• Arbitrary file read/write via archive extraction path confusion and link resolution.

Who is impacted:

• Any application/service that extracts attacker-controlled tar archives with Node tar defaults.
• Impact scope is the privileges of the extracting process user.

Potential outcomes:

• Read sensitive files reachable by the process user.
• Overwrite writable files outside extraction root.
• Escalate impact depending on deployment context (keys, configs, scripts, app data).

CVE-2026-29786

Summary

tar (npm) can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction.

Details

The extraction logic in Unpack[STRIPABSOLUTEPATH] checks for .. segments before stripping absolute roots.

What happens with linkpath: "C:../target.txt":

1. Split on / gives ['C:..', 'target.txt'], so parts.includes('..') is false.
2. stripAbsolutePath() removes C: and rewrites the value to ../target.txt.
3. Hardlink creation resolves this against extraction cwd and escapes one directory up.
4. Writing through the extracted hardlink overwrites the outside file.

This is reachable in standard usage (tar.x({ cwd, file })) when extracting attacker-controlled tar archives.

PoC

Tested on Arch Linux with tar@7.5.9.

PoC script (poc.cjs):

const fs = require('fs')
const path = require('path')
const { Header, x } = require('tar')

const cwd = process.cwd()
const target = path.resolve(cwd, '..', 'target.txt')
const tarFile = path.join(process.cwd(), 'poc.tar')

fs.writeFileSync(target, 'ORIGINAL\n')

const b = Buffer.alloc(1536)
new Header({ path: 'l', type: 'Link', linkpath: 'C:../target.txt' }).encode(b, 0)
fs.writeFileSync(tarFile, b)

x({ cwd, file: tarFile }).then(() => {
  fs.writeFileSync(path.join(cwd, 'l'), 'PWNED\n')
  process.stdout.write(fs.readFileSync(target, 'utf8'))
})

Run:

cd test-workspace
node poc.cjs && ls -l ../target.txt

Observed output:

PWNED
-rw-r--r-- 2 joshuavr joshuavr 6 Mar  4 19:25 ../target.txt

PWNED confirms outside file content overwrite. Link count 2 confirms the extracted file and ../target.txt are hardlinked.

Impact

This is an arbitrary file overwrite primitive outside the intended extraction root, with the permissions of the process performing extraction.

Realistic scenarios:

• CLI tools unpacking untrusted tarballs into a working directory
• build/update pipelines consuming third-party archives
• services that import user-supplied tar files

---

Release Notes

isaacs/node-tar (tar)

v7.5.10

Compare Source

v7.5.9

Compare Source

v7.5.8

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

---

This change is 

[renovate-maintainx]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[BobbyWhiskey]

@BobbyWhiskey reviewed all commit messages.
Reviewable status: 0 of 2 files reviewed, all discussions resolved.