A high-severity path traversal vulnerability in the node-tar package poses a significant risk of unauthorized file system access via malicious archive processing.

The vulnerability arises from a discrepancy between path resolution semantics during security checks and actual hardlink creation logic. An unauthenticated attacker can supply a specially crafted TAR file to bypass path traversal protections, leading to arbitrary hardlink creation.

This vulnerability carries a CVSS score of 8.2, reflecting its potential for unauthorized file system interaction. Successful exploitation allows an attacker to create hardlinks to sensitive files, which may lead to information disclosure or compromise of system integrity, depending on how the application handles the resulting file links.

Immediate Action: Update the node-tar package to version 7.5.7 or later to implement the corrected path resolution logic.

Proactive Monitoring: Review application logs for errors related to file extraction, archive processing, or unusual file system activity occurring after archive decompression.

Compensating Controls: Ensure that applications processing untrusted TAR files run with the principle of least privilege, specifically limiting write access to the filesystem outside of designated temporary directories.

Public Exploit Available: Unknown.

Given the prevalence of the node-tar library in the Node.js ecosystem, organizations must prioritize auditing their dependency trees to identify and update vulnerable instances. Applying the patch to version 7.5.7 is the only reliable method to mitigate the risk of arbitrary hardlink creation and subsequent path traversal attacks.