CVE-2026-23745
HighAdvisory
Published 16 Jan 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.004
- 32nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 774
- of 17,781 indexed, latest versions
- Container images
- 798
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Carried by container images the latest versions of 774 of 17,781 indexed charts deploy, on 798 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| tarnpm | 1.0.3, 2.2.1, 2.2.2, 4.0.2+23 more | 7.5.3 | 798 |
| node-tardeb | 1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3 | no fix listed | 6 |
- OSV records
- GHSA-8qq5-rm4j-mr97UBUNTU-CVE-2026-23745
Charts affected
774 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| grafana-pdf-exporterwiremindVerified publisher | 2.1.1 | 1 of 1See more | 9,746 |
| code-serveralekcVerified publisher | 0.1.1 | 1 of 1See more | 8,212 |
| codetogethercodetogether | 1.4.25 | 1 of 1See more | 7,450 |
| community-solid-servercommunity-solid-server | 3.0.0 | 1 of 1See more | 1,613 |
| foremancontane-githubOfficialVerified publisher | 0.6.0 | 1 of 1See more | 1,152 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 3 of 10See more | 28,839 |
| hubotdecayofmind | 1.0.2 | 1 of 3See more | 2,513 |
| hoppscotchdeliveryheroVerified publisher | 0.3.2 | 1 of 1See more | 3,451 |
| nightscoutgabe565Verified publisher | 0.13.0 | 1 of 2See more | 2,521 |
| audiobookshelfgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,959 |
| calibregeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 22,773 |
| mealiegeek-cookbookVerified publisher | 5.1.2 | 1 of 2See more | 7,579 |
| zwavejs2mqttgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 3,476 |
| graphql-hivegraphql-hive | 1.0.0 | 9 of 17See more | 10,311 |
| coreinstill-aiOfficialVerified publisher | 0.1.75 | 1 of 15See more | 30,816 |
| kongakonga | 1.1.0 | 1 of 1See more | 5,209 |
| kubeviouskubevious | 1.2.2 | 4 of 7See more | 14,204 |
| activepiecesmeyerchartsVerified publisher | 0.1.6 | 1 of 1See more | 2,635 |
| flagsmithone-acre-fundVerified publisher | 0.1.5 | 1 of 6See more | 6,868 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| n8none-acre-fundVerified publisher | 0.1.52 | 1 of 3See more | 7,776 |
| kratos-selfservice-ui-nodeory | 0.64.0 | 1 of 1See more | 1,966 |
| overseerrpree-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,702 |
| laravelrenoki-co | 1.0.0 | 1 of 2See more | 6,931 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 977 |
| browserless-chromesagikazarmarkVerified publisher | 0.0.5 | 1 of 1See more | 24,488 |
| soketisoketi | 2.0.0 | 1 of 1See more | 1,636 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,566 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 3 of 10See more | 28,534 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| predatorzooz | 1.7.0 | 1 of 1See more | 2,851 |
| github-actions-runneradwerx | 0.10.3 | 1 of 1See more | 13,635 |
| bredbandskollen-prometheus-exporteraolde | 0.2.3 | 1 of 1See more | 1,972 |
| dbgateappscodeVerified publisher | 2026.3.30 | 1 of 1See more | 458 |
| soarv113assist-iot-cybersecurity-monitoring-soar | 0.1.3 | 1 of 5See more | 17,896 |
| siemassist-iot-cybersecurity-monitroting-siem | 0.1.0 | 1 of 3See more | 10,730 |
| dltbrokerassist-iot-distributed-broker | 0.2.0 | 3 of 9See more | 77,706 |
| dltloggingassist-iot-logging-auditing | 0.2.0 | 3 of 9See more | 77,687 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 1,991 |
| actualbeluga-cloudVerified publisher | 2.0.0 | 1 of 1See more | 1,262 |
| opensearch-dashboardscaptnbpVerified publisher | 2.2.1 | 1 of 1See more | 1,843 |
| fluxcd-webuiccowleyVerified publisher | 0.0.2 | 1 of 2See more | 3,509 |
| maildevchristianhuthVerified publisher | 1.6.0 | 1 of 1See more | 1,143 |
| skoonerchristianhuthVerified publisher | 0.4.0 | 1 of 1See more | 1,341 |
| squestchristianhuthVerified publisher | 6.6.7 | 1 of 4See more | 9,971 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 8 of 12See more | 38,346 |
| mastodondefault-ghVerified publisher | 0.3.1 | 1 of 3See more | 5,056 |
| joplin-serverdjjudas21Verified publisher | 5.5.8 | 1 of 1See more | 3,925 |
| domain-lockerdomain-locker | 0.2.8 | 1 of 3See more | 1,882 |
Container images carrying it
798 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| moreillon/ | 0a8a7daf56f6 | tar | 7.5.3 | 1 |
| moreillon/ | d2ee0423b797 | tar | 7.5.3 | 1 |
| mozilla/ | 1da6ff5c4895 | tar | 7.5.3 | 1 |
| mpopoola1/ | 061fc532de7d | tar | 7.5.3 | 1 |
| muluder/ | 43b597a93da7 | tar | 7.5.3 | 1 |
| n8nio/ | 8b39ed5a2de9 | tar | 7.5.3 | 1 |
| n8nio/ | a9195bc499a3 | tar | 7.5.3 | 1 |
| n8nio/ | dd171d45102a | tar | 7.5.3 | 1 |
| neoskop/ | 7f52b5949f03 | tar | 7.5.3 | 1 |
| netrisai/ | 6e865080e86c | tar | 7.5.3 | 1 |
| nightscout/ | 00c3b4833f1b | tar | 7.5.3 | 1 |
| nightscout/ | ad29ca7a4de6 | tar | 7.5.3 | 1 |
| nightscout/ | f604dc4c03ca | tar | 7.5.3 | 1 |
| nocodb/ | 6779a4ddedf2 | tar | 7.5.3 | 1 |
| nocodb/ | d9516f0bf546 | tar | 7.5.3 | 1 |
| nodered/ | 216e7403aab9 | tar | 7.5.3 | 1 |
| nodered/ | d73ae167cb9b | tar | 7.5.3 | 1 |
| nodered/ | e131dcadfe92 | tar | 7.5.3 | 1 |
| nodered/ | e2632a7a35dd | tar | 7.5.3 | 1 |
| nodered/ | 070643219ea2 | tar | 7.5.3 | 1 |
| nonkronk/ | 0a3694d70647 | tar | 7.5.3 | 1 |
| nottiey/ | 9c35a24c9eb3 | tar | 7.5.3 | 1 |
| oada/ | c0d077e79ef4 | tar | 7.5.3 | 1 |
| oada/ | d87efe8ba4b0 | tar | 7.5.3 | 1 |
| oada/ | ebc8343f05ff | tar | 7.5.3 | 1 |
| oada/ | c6ffb4e8ed63 | tar | 7.5.3 | 1 |
| oada/ | fc09495e2f3c | tar | 7.5.3 | 1 |
| oada/ | b7a2cfc137cf | tar | 7.5.3 | 1 |
| oada/ | b6c562fa5b1b | tar | 7.5.3 | 1 |
| oada/ | 6590c60de347 | tar | 7.5.3 | 1 |
| oada/ | 7943fde43b19 | tar | 7.5.3 | 1 |
| oada/ | 8464c7f48aae | tar | 7.5.3 | 1 |
| obolnetwork/ | e263be0a7440 | tar | 7.5.3 | 1 |
| ohmyform/ | afe53f4acdb1 | tar | 7.5.3 | 1 |
| okaforuchena/ | 004e81250f48 | tar | 7.5.3 | 1 |
| omecproject/ | 5715e5648aa0 | tar | 7.5.3 | 1 |
| ondrejsika/ | b1fd497416c8 | tar | 7.5.3 | 1 |
| ooghenekaro/ | 03394ba1d6d8 | tar | 7.5.3 | 1 |
| ooghenekaro/ | d1f972aa844a | tar | 7.5.3 | 1 |
| ooghenekaro/ | ea5b71588a76 | tar | 7.5.3 | 1 |
| ooghenekaro/ | e010f5fecbc7 | tar | 7.5.3 | 1 |
| opea/ | 2bee4eb66f3e | tar | 7.5.3 | 1 |
| opea/ | 3ef121f34610 | tar | 7.5.3 | 1 |
| opea/ | 7f854e9bffaf | tar | 7.5.3 | 1 |
| openbas/ | a277796d9724 | tar | 7.5.3 | 1 |
| opendatacube/ | 80df355a660b | tar | 7.5.3 | 1 |
| openemr/ | 89eaa6d9a4e3 | tar | 7.5.3 | 1 |
| openhab/ | 29dd2bac8c4b | tar | 7.5.3 | 1 |
| openmined/ | d11524a3854a | tar | 7.5.3 | 1 |
| openproject/ | 734743d11094 | tar | 7.5.3 | 1 |