Tar

This hub aggregates every CVE we track for Tar, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Tar.

• CVE-2026-18477Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape4.4Aug 3, 2026
• CVE-2026-18508Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite4.4Aug 3, 2026
• GHSA-r292-9mhp-454mnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionJul 24, 2026
• CVE-2026-59871node-tar: Process crash via PAX numeric path type confusion5.3Jul 8, 2026
• CVE-2026-59874node-tar: Negative tar entry size causes infinite loop in archive replace7.5Jul 8, 2026
• CVE-2026-59873node-tar: Decompression/parse DoS via unlimited input7.5Jul 8, 2026
• CVE-2026-53655node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)5.5Jun 22, 2026
• GHSA-3pv8-6f4r-ffg2tar has a PAX header desynchronization issueMay 29, 2026
• CVE-2026-5704Tar: tar: hidden file injection via crafted archives5.0Apr 6, 2026
• CVE-2026-33056tar-rs: unpack_in can chmod arbitrary directories by following symlinks6.5Mar 20, 2026
• CVE-2026-31802node-tar Symlink Path Traversal via Drive-Relative Linkpath5.5Mar 9, 2026
• CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpath6.3Mar 7, 2026
• CVE-2026-26960node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction7.1Feb 20, 2026
• CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal8.2Jan 28, 2026
• CVE-2026-23950node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS8.8Jan 20, 2026