CVE-2026-23745
HighAdvisory
Published 16 Jan 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.004
- 32nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 775
- of 17,787 indexed, latest versions
- Container images
- 799
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Carried by container images the latest versions of 775 of 17,787 indexed charts deploy, on 799 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| tarnpm | 1.0.3, 2.2.1, 2.2.2, 4.0.2+23 more | 7.5.3 | 799 |
| node-tardeb | 1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3 | no fix listed | 6 |
- OSV records
- GHSA-8qq5-rm4j-mr97UBUNTU-CVE-2026-23745
Charts affected
775 by stars
Container images carrying it
799 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| moreillon/ | 3caa8f710ee0 | tar | 7.5.3 | 1 |
| moreillon/ | 0a8a7daf56f6 | tar | 7.5.3 | 1 |
| moreillon/ | d2ee0423b797 | tar | 7.5.3 | 1 |
| mozilla/ | 1da6ff5c4895 | tar | 7.5.3 | 1 |
| mpopoola1/ | 061fc532de7d | tar | 7.5.3 | 1 |
| muluder/ | 43b597a93da7 | tar | 7.5.3 | 1 |
| n8nio/ | 8b39ed5a2de9 | tar | 7.5.3 | 1 |
| n8nio/ | a9195bc499a3 | tar | 7.5.3 | 1 |
| n8nio/ | dd171d45102a | tar | 7.5.3 | 1 |
| n8nio/ | ed16e560c40e | tar | 7.5.3 | 1 |
| neoskop/ | 7f52b5949f03 | tar | 7.5.3 | 1 |
| netrisai/ | 6e865080e86c | tar | 7.5.3 | 1 |
| nightscout/ | 00c3b4833f1b | tar | 7.5.3 | 1 |
| nightscout/ | ad29ca7a4de6 | tar | 7.5.3 | 1 |
| nightscout/ | f604dc4c03ca | tar | 7.5.3 | 1 |
| nocodb/ | 6779a4ddedf2 | tar | 7.5.3 | 1 |
| nocodb/ | d9516f0bf546 | tar | 7.5.3 | 1 |
| nodered/ | 216e7403aab9 | tar | 7.5.3 | 1 |
| nodered/ | d73ae167cb9b | tar | 7.5.3 | 1 |
| nodered/ | e131dcadfe92 | tar | 7.5.3 | 1 |
| nodered/ | e2632a7a35dd | tar | 7.5.3 | 1 |
| nodered/ | 070643219ea2 | tar | 7.5.3 | 1 |
| nonkronk/ | 0a3694d70647 | tar | 7.5.3 | 1 |
| nottiey/ | 9c35a24c9eb3 | tar | 7.5.3 | 1 |
| oada/ | c0d077e79ef4 | tar | 7.5.3 | 1 |
| oada/ | d87efe8ba4b0 | tar | 7.5.3 | 1 |
| oada/ | ebc8343f05ff | tar | 7.5.3 | 1 |
| oada/ | c6ffb4e8ed63 | tar | 7.5.3 | 1 |
| oada/ | fc09495e2f3c | tar | 7.5.3 | 1 |
| oada/ | b7a2cfc137cf | tar | 7.5.3 | 1 |
| oada/ | b6c562fa5b1b | tar | 7.5.3 | 1 |
| oada/ | 6590c60de347 | tar | 7.5.3 | 1 |
| oada/ | 7943fde43b19 | tar | 7.5.3 | 1 |
| oada/ | 8464c7f48aae | tar | 7.5.3 | 1 |
| obolnetwork/ | e263be0a7440 | tar | 7.5.3 | 1 |
| ohmyform/ | afe53f4acdb1 | tar | 7.5.3 | 1 |
| okaforuchena/ | 004e81250f48 | tar | 7.5.3 | 1 |
| omecproject/ | 5715e5648aa0 | tar | 7.5.3 | 1 |
| ondrejsika/ | b1fd497416c8 | tar | 7.5.3 | 1 |
| ooghenekaro/ | 03394ba1d6d8 | tar | 7.5.3 | 1 |
| ooghenekaro/ | d1f972aa844a | tar | 7.5.3 | 1 |
| ooghenekaro/ | ea5b71588a76 | tar | 7.5.3 | 1 |
| ooghenekaro/ | e010f5fecbc7 | tar | 7.5.3 | 1 |
| opea/ | 2bee4eb66f3e | tar | 7.5.3 | 1 |
| opea/ | 3ef121f34610 | tar | 7.5.3 | 1 |
| opea/ | 7f854e9bffaf | tar | 7.5.3 | 1 |
| openbas/ | a277796d9724 | tar | 7.5.3 | 1 |
| opendatacube/ | 80df355a660b | tar | 7.5.3 | 1 |
| openemr/ | 89eaa6d9a4e3 | tar | 7.5.3 | 1 |
| openhab/ | 29dd2bac8c4b | tar | 7.5.3 | 1 |