{"action":"Upgrade tar to 7.5.8 or later.","affected":[{"fixed":"7.5.8","introduced":"0"}],"component":"tar","cve_ids":["CVE-2026-26960"],"ecosystem":"npm","epss":0.00328,"exploited":false,"fixed_versions":["7.5.8"],"ghsa_id":"GHSA-83g3-92jg-28cx","id":"tcs_01M5KFBJ501F5R46JB1CFR79Y8","modified_at":"2026-09-10T03:50:34.418493270Z","published_at":"2026-02-18T00:57:13Z","references":["https://osv.dev/vulnerability/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://nvd.nist.gov/vuln/detail/CVE-2026-26960","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-83g3-92jg-28cx","url":"https://osv.dev/vulnerability/GHSA-83g3-92jg-28cx"}],"summary":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction"}