Rohitberiwala/NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

PoC

Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package (CVE-2026-29786)

view exploit source poc_in_githubauthor Rohitberiwalapublished 2026-03-10catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-29786USmedium6.3Exploit
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-rela…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan