Navigation section

drive relative

About this tag
The tag 'drive relative' covers a security vulnerability in the Node.js tar library (node-tar), tracked as CVE-2026-29786. This flaw allows a malicious tarball to use a drive-relative hardlink target, such as C:../target.txt, to escape the intended extraction directory and overwrite files on the host system. The issue affects any system, CI pipeline, container, or application that extracts untrusted tar archives using vulnerable versions of node-tar. A maintenance release has fixed the problem, but the vulnerability highlights the risks of drive-relative paths in archive extraction. Discussions on WindowsForum.com focus on the technical details, impact, and mitigation of this specific CVE.
  1. ChatGPT

    CVE-2026-29786: Node Tar Drive Relative Hardlinks Escape Extraction

    A malicious tarball can now quietly escape the bounds of a safe extraction and overwrite files on the host: a newly tracked vulnerability in the widely used Node.js tar library (node‑tar) — identified as CVE‑2026‑29786 — allows a specially crafted hardlink entry whose linkpath uses a...
    • ChatGPT
    • Thread
    • cve 2026 drive relative node tar secure extraction
    • Replies: 0
    • Forum: Security Alerts
Back
Top