https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:36:10.384844+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07231 bdu:2026-07231 2026-10-02T15:36:10.576172+00:00 bdu:2026-07231 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0266 certfr-2026-avi-0266 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob… 2026-10-02T15:36:10.576218+00:00 certfr-2026-avi-0266 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad27625 Withdrawn: CLEANSTART-2026-AD27625 — Security fixes for CVE-2022-25881, CVE-2022-33987, CVE-2025-25285, CVE-2025-62718, CVE-2025-69873, CVE-2026-21637, CVE-… 2026-10-02T15:36:10.576246+00:00

Withdrawn by the publisher.

Affected: CleanStart: mongosh

Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-268923 EUVD-2026-268923 2026-10-02T15:36:10.576292+00:00 EUVD-2026-268923 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26960 fkie_cve-2026-26960 2026-10-02T15:36:10.576305+00:00

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

 https://cve.radiocsirt.org/vuln/ghsa-83g3-92jg-28cx GHSA-83g3-92jg-28cx — Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction 2026-10-02T15:36:10.576329+00:00

Affected: npm: tar

### Summary `tar.extract()` in Node `tar` allows an attacker-controlled archive to create a hardlink inside the extraction directory that points to a file outside the extraction root, using default options.

This enables **arbitrary file read and write** as the extracting user (no root, no chmod, no `preservePaths`).

Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive.

### Details The bypass chain uses two symlinks plus one hardlink:

1. `a/b/c/up -> ../..` 2. `a/b/escape -> c/up/../..` 3. `exfil` (hardlink) -> `a/b/escape/<target-relative-to-parent-of-extract>`

Why this works:

- Linkpath checks are string-based and do not resolve symlinks on disk for hardlink target safety. - See `STRIPABSOLUTEPATH` logic in: - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:255` - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:268` - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:281`

- Hardlink extraction resolves target as `path.resolve(cwd, entry.linkpath)` and then calls `fs.link(target, destination)`. - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:566` - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:567` - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:703`

- Parent directory safety checks (`mkdir` + symlink detection) are applied to the destination p…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-26960 msrc_CVE-2026-26960 — node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction 2026-10-02T15:36:10.576378+00:00 msrc_CVE-2026-26960 https://cve.radiocsirt.org/vuln/rhsa-2026:5447 RHSA-2026:5447 — Red Hat Security Advisory: RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release 2026-10-02T15:36:10.576395+00:00

golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-26960 UBUNTU-CVE-2026-26960 2026-10-02T15:36:10.576419+00:00

Affected: Ubuntu:Pro:14.04:LTS: node-tar, Ubuntu:Pro:16.04:LTS: node-tar, Ubuntu:18.04:LTS: node-tar, Ubuntu:Pro:20.04:LTS: node-tar, Ubuntu:22.04:LTS: node-tar, Ubuntu:24.04:LTS: node-tar, Ubuntu:25.10: node-tar, Ubuntu:26.04:LTS: node-tar

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1229 WID-SEC-W-2026-1229 — Atlassian Bamboo, Bitbucket, Confluence, Jira: Mehrere Schwachstellen 2026-10-02T15:36:10.576488+00:00

Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.