CVE-2026-29786

MediumCVSS 6.3/10Last modified Sep 1, 2026

Description

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-22CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2026
Last modified
Sep 1, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-297875.3mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint retCVE-2026-297887.5TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and trCVE-2026-297898.8Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3CVE-2026-29798.8A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function user_avatar_upload_controller of the file /backend/app/apCVE-2026-297905.3dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversaCVE-2026-297916.5Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version CVE-2026-297929.8Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unCVE-2026-297939.8Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, SockCVE-2026-297945.3Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users arCVE-2026-297957.5stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_strCVE-2026-297969.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate dCVE-2026-297977.1No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additiona