The node-tar library versions up to 7.5.2 fail to properly sanitize the linkpath of hardlink and symbolic link entries during archive extraction when preservePaths is false. This improper limitation of pathname to a restricted directory (CWE-22) enables attackers to craft malicious tar archives that can overwrite arbitrary files or poison symbolic links on the filesystem. The vulnerability is addressed in node-tar version 7.5.3. Red Hat has rated this vulnerability as Important for its products using node-tar and has issued advisories detailing the impact and mitigation status.

An attacker can create malicious tar archives that, when extracted, bypass intended security restrictions, leading to arbitrary file overwrite and symlink poisoning. This can result in unauthorized modification of critical files, potentially allowing code execution, bypassing security mechanisms, exposing sensitive data, or causing denial of service by corrupting important files. The CVSS 4.0 base score is 8.2 (high severity), reflecting high confidentiality and integrity impact with local attack vector and low complexity.

A fix for this vulnerability is available in node-tar version 7.5.3. Users and vendors should upgrade to this version to remediate the issue. Red Hat advisories indicate that no suitable mitigation other than upgrading meets their criteria for ease of use and deployment. Therefore, upgrading to a fixed version is the recommended remediation. For Red Hat products, monitor official advisories for updates and apply patches when available.