node-tar, a Node.js module for handling TAR archives, contains a vulnerability in versions before 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This discrepancy allows crafted malicious TAR archives to bypass path traversal protections and create hardlinks to arbitrary files outside the intended extraction directory. This vulnerability can lead to unauthorized information disclosure or system compromise. The fix is included in node-tar version 7.5.7. Red Hat advisories confirm the vulnerability affects their products that use node-tar, and no suitable mitigation other than upgrading is currently available.

An attacker can craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. This can result in unauthorized disclosure of sensitive information or further compromise of the affected system. The CVSS v3.1 score is 8.2 (high severity) with network attack vector, low complexity, no privileges required, user interaction required, and scope changed. Confidentiality impact is high, integrity impact is low, and availability impact is none.

A fix is available in node-tar version 7.5.7. Users and vendors should upgrade to this version or later to remediate the vulnerability. Red Hat advisories indicate that no effective mitigation other than upgrading currently meets their criteria for ease of use and applicability. Therefore, upgrading to a fixed version is the recommended remediation.