Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

tar npm packages can execute code on your system

CVE-2026-29786 · published 1 day ago
Summary

The tar libraries used in Node.js applications (such as canonical/node-tar, debian/node-tar, isaacs/tar, @rootio/tar, and isaacs/node-tar) contain a flaw that could let a malicious archive run code on the host. This could lead to unauthorized actions or data compromise. Update each tar package to the latest released version as soon as possible to apply the fix.

What to do
  • Update debian node-tar to version 6.2.1+ds1+~cs6.1.13-8.
  • Update isaacs tar to version 7.5.10.
  • Update rootio @rootio/tar to version 7.5.9-root.io.3.
  • Update isaacs tar to version 7.5.9-aikido.3.
  • Update rootio @rootio/tar to version 6.2.0-root.io.9.
  • Update rootio @rootio/tar to version 6.1.13-root.io.2.
  • Update rootio @rootio/tar to version 6.1.14-root.io.2.
  • Update rootio @rootio/tar to version 7.5.9-root.io.1.
  • Update rootio @rootio/tar to version 7.5.7-root.io.3.
  • Update rootio @rootio/tar to version 6.1.11-root.io.3.
  • Update isaacs tar to version 7.5.1-aikido.9.
  • Update rootio @rootio/tar to version 7.5.1-root.io.9.
  • Update rootio @rootio/tar to version 6.1.14-root.io.3.
  • Update isaacs tar to version 6.1.14-aikido.3.
  • Update isaacs tar to version 6.1.11-aikido.6.
  • Update rootio @rootio/tar to version 6.1.11-root.io.6.
  • Update isaacs tar to version 7.5.1-aikido.10.
  • Update rootio @rootio/tar to version 7.5.1-root.io.10.
  • Update isaacs tar to version 6.2.1-aikido.9.
  • Update rootio @rootio/tar to version 6.2.1-root.io.9.
  • Update rootio @rootio/tar to version 6.1.11-root.io.7.
  • Update isaacs tar to version 6.1.11-aikido.7.
  • Update tar to version 7.5.7-aikido.6.
  • Update isaacs tar to version 7.4.3-aikido.9.
  • Update rootio @rootio/tar to version 7.4.3-root.io.9.
  • Update rootio @rootio/tar to version 7.5.7-root.io.6.
  • Update isaacs tar to version 4.4.19-aikido.6.
  • Update rootio @rootio/tar to version 4.4.19-root.io.6.
  • Update rootio @rootio/tar to version 7.5.9-root.io.4.
  • Update isaacs tar to version 7.5.9-aikido.4.
  • Update rootio @rootio/tar to version 7.5.9-root.io.5.
  • Update isaacs tar to version 7.5.9-aikido.5.
  • Update rootio @rootio/tar to version 6.1.13-root.io.4.
  • Update isaacs tar to version 6.1.13-aikido.4.
  • Update rootio @rootio/tar to version 6.1.13-root.io.6.
  • Update isaacs tar to version 7.4.3-aikido.12.
  • Update rootio @rootio/tar to version 7.4.3-root.io.12.
  • Update isaacs tar to version 6.1.13-aikido.6.
  • Update tar to version 7.4.3-aikido.12.
  • Update debian node-tar to version 6.1.13+~cs7.0.5-1+deb12u1.
  • Update debian node-tar to version 6.2.1+~cs7.0.8-1+deb13u1.
  • Update tar to version 4.4.13-aikido.1.
  • Update rootio @rootio/tar to version 4.4.13-root.io.1.
  • Update tar to version 6.2.0-aikido.11.
  • Update rootio @rootio/tar to version 6.2.0-root.io.11.
  • Update tar to version 7.5.7-aikido.5.
  • Update rootio @rootio/tar to version 7.5.7-root.io.5.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:14.04:LTS canonical node-tar All versions
Ubuntu:Pro:16.04:LTS canonical node-tar All versions
Ubuntu:18.04:LTS canonical node-tar All versions
Ubuntu:Pro:20.04:LTS canonical node-tar All versions
Ubuntu:22.04:LTS canonical node-tar All versions
Ubuntu:24.04:LTS canonical node-tar All versions
Ubuntu:25.10 canonical node-tar All versions
Debian:11 debian node-tar All versions
Debian:12 debian node-tar < 6.1.13+~cs7.0.5-1+deb12u1
Fix: upgrade to 6.1.13+~cs7.0.5-1+deb12u1
Debian:13 debian node-tar < 6.2.1+~cs7.0.8-1+deb13u1
Fix: upgrade to 6.2.1+~cs7.0.8-1+deb13u1
Debian:14 debian node-tar < 6.2.1+ds1+~cs6.1.13-8
Fix: upgrade to 6.2.1+ds1+~cs6.1.13-8
npm isaacs tar <= 7.5.9
< 7.5.10
Fix: upgrade to 7.5.10
– isaacs tar < 7.5.10
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*
Root:npm rootio @rootio/tar < 7.5.9-root.io.3
< 6.2.0-root.io.9
< 6.1.13-root.io.2
< 6.1.14-root.io.2
< 7.5.9-root.io.1
< 7.5.7-root.io.3
< 6.1.11-root.io.3
< 7.5.1-root.io.9
< 6.1.14-root.io.3
< 6.1.11-root.io.6
< 7.5.1-root.io.10
< 6.2.1-root.io.9
12 more version ranges
Fix: upgrade to 7.5.9-root.io.3
Root:npm isaacs tar < 7.5.9-aikido.3
< 7.5.1-aikido.9
< 6.1.14-aikido.3
< 6.1.11-aikido.6
< 7.5.1-aikido.10
< 6.2.1-aikido.9
< 6.1.11-aikido.7
< 7.4.3-aikido.9
< 4.4.19-aikido.6
< 7.5.9-aikido.4
< 7.5.9-aikido.5
< 6.1.13-aikido.4
2 more version ranges
Fix: upgrade to 7.5.9-aikido.3
– isaacs node-tar < 7.5.10
Root:npm – tar < 7.5.7-aikido.6
< 7.4.3-aikido.12
< 4.4.13-aikido.1
< 6.2.0-aikido.11
< 7.5.7-aikido.5
Fix: upgrade to 7.5.7-aikido.6
Original advisory text
CVE-2026-29786 in tar - Patched by Root
Root has patched CVE-2026-29786 in the tar package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-59Link Following
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
UBUNTU-CVE-2026-29786 · OSV
DEBIAN-CVE-2026-29786 · OSV
ROOT-APP-NPM-CVE-2026-29786 · OSV
GHSA-qffp-2rhf-9h96 · GHSA
CVE-2026-29786 · NVD
GHSA-qffp-2rhf-9h96 · OSV
CVE-2026-29786 · MITRE
CVE-2026-29786 · OSV
Track software like this
Free during beta