Security readout for executives and security teams
Plain-English summary
Applications using vulnerable node-tar versions can let a malicious archive write or redirect files outside the intended extraction directory. Exploitation requires the application or a user to extract the crafted archive, but successful abuse could damage files or affect other security contexts accessible to the extraction process.
Executive priority
Prioritize remediation for internet-facing upload services, CI/CD systems, package-processing services, and privileged extraction jobs. Upgrade promptly where untrusted archives are processed; other installations should follow normal high-severity patch timelines after confirming whether extraction functionality is reachable.
Technical view
node-tar before 7.5.3 insufficiently validates link targets for hardlink and symbolic-link archive entries when preservePaths is false. Crafted link paths can bypass extraction-root restrictions, enabling arbitrary file overwrite through hardlinks or symlink poisoning through absolute targets. The issue is classified as CWE-22 and scored CVSS 4.0 8.2.
Likely exposure
Exposure is most likely where node-tar below 7.5.3 extracts archives from users, uploads, build inputs, package workflows, or other insufficiently trusted sources. Risk depends on the extraction process's filesystem permissions and whether vulnerable node-tar is present directly or transitively.
Exploitation context
The supplied record identifies a local attack vector and required user action. It does not establish active exploitation, and the CVE is not marked as CISA KEV in the supplied bundle. Treat attacker-controlled archive extraction as the principal risk condition.
Researcher notes
The vulnerable validation concerns linkpath rather than only archive entry names, so assessments should examine hardlink and symbolic-link handling. preservePaths being false does not provide the expected containment in affected versions. The supplied sources identify 7.5.3 as fixed but provide no evidence here of exploitation in the wild.
Mitigation direction
- Upgrade node-tar to version 7.5.3 or later.
- Update lockfiles and rebuild deployments so vulnerable transitive copies are removed.
- Restrict or suspend extraction of untrusted archives until upgrades are complete.
- Run archive extraction with minimal filesystem permissions and isolation.
- Apply applicable Red Hat security advisories for vendor-managed packages.
Validation and detection
- Inventory direct and transitive node-tar versions across applications, build systems, and deployed artifacts.
- Confirm runtime dependency trees contain no node-tar version below 7.5.3.
- Identify every workflow that extracts externally supplied or insufficiently trusted archives.
- Verify extraction processes cannot modify sensitive files outside their intended working directories.
- Test that security controls reject link entries attempting to escape the extraction root.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23745 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N——GitHub_MCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H1.56redhat-SADPVulnerability scoring details
Base CVSS 4.0 score
8.2HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-16T23:01:26.508Z: Reported to Red Hat.
- 2026-01-16T22:00:08.769Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405eCVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-23745CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2430538CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:18480CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18868CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2900CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3782CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6192CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2926CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2144CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.