Loading vulnerability…
CVE-2026-31802 affects node-tar, the tar npm package for Node.js. In versions prior to 7.5.11, normal tar.x() extraction can be abused with a crafted archive containing a drive-relative symlink target such as "C:../../../target.txt". This can cause tar to create a symlink that resolves outside the intended extraction directory, bypassing extraction path constraints. As a result, subsequent extraction behavior can overwrite files outside the current working directory. The issue is a path traversal/symlink handling flaw in archive extraction and is fixed in node-tar 7.5.11.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository is a minimal proof-of-concept for CVE-2026-31802 affecting the npm 'tar' package. It contains two files: a README with descriptive and download-oriented text, and a single executable PoC script, 'poc.cjs'. The actual exploit logic is entirely in 'poc.cjs'. The script uses Node.js modules 'fs' and 'path' plus the 'tar' package's Header and extraction API. It creates '../target.txt' with known content, allocates a tar buffer, and encodes a symbolic-link tar header for path 'a/b/l' pointing to 'C:../../../target.txt'. It writes this crafted archive to 'poc.tar', extracts it into the current working directory with tar.x(), and then writes 'PWNED\n' to 'a/b/l'. If the vulnerable tar handling permits the symlink/path traversal behavior, that write resolves outside the extraction directory and overwrites '../target.txt'. Finally, the script reads and prints the target file to confirm success. There are no network callbacks, shells, persistence mechanisms, or remote-control features; this is a local file-write/path-traversal demonstration intended to validate the vulnerability and show arbitrary overwrite impact.
This repository is a minimal proof-of-concept for CVE-2026-31802 affecting the npm tar package (node-tar) <= 7.5.10. It contains two files: a README with a detailed write-up and reproduction steps, and a single executable PoC script, poc.cjs. The script uses the tar library's Header and x APIs to manually construct a tar archive containing a symbolic link entry at a/b/l whose linkpath is the crafted drive-relative value C:../../../target.txt. It writes the archive to poc.tar, extracts it into the current working directory, and then writes through the extracted symlink. If the vulnerable tar version is in use, that write lands in ../target.txt outside the extraction root, proving an arbitrary file overwrite primitive via symlink path traversal. There are no network capabilities, callbacks, or remote endpoints; the exploit is entirely local and filesystem-based. The repository's purpose is to demonstrate the root cause, exploitation flow, and impact of the validation mismatch in tar's symlink extraction logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A file inclusion vulnerability affecting Jira Software Data Center and Jira Service Management Data Center.
File inclusion vulnerability in the node-tar dependency affecting Confluence Data Center.
A path traversal / symlink escape issue in node-tar (tar npm package) on Windows where a crafted archive can create a drive-relative symlink that points outside the extraction directory, enabling file overwrite outside the current working directory during extraction.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.