CVE-2018-20834: Isaacs Tar

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Affected products

• Isaacs Tar: before 2.2.2 (fixed in 2.2.2); from 3.0.0, before 4.4.2 (fixed in 4.4.2)

Published 2019-04-30. Last modified 2026-06-17.