CVE-2026-23745
HighAdvisory
Published 16 Jan 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.004
- 32nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 774
- of 17,781 indexed, latest versions
- Container images
- 798
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Carried by container images the latest versions of 774 of 17,781 indexed charts deploy, on 798 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| tarnpm | 1.0.3, 2.2.1, 2.2.2, 4.0.2+23 more | 7.5.3 | 798 |
| node-tardeb | 1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3 | no fix listed | 6 |
- OSV records
- GHSA-8qq5-rm4j-mr97UBUNTU-CVE-2026-23745
Charts affected
774 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| rstudiodsri-helm-charts | 0.1.28 | 1 of 1See more | 5,670 |
| enbuildenbuildVerified publisher | 0.0.50 | 1 of 6See more | 31,510 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 1,442 |
| iobrokereugen | 0.2.6 | 1 of 1See more | 11,458 |
| atlas-cmmsf3k-techVerified publisher | 0.151.5 | 1 of 4See more | 5,291 |
| taigafermosit | 0.0.11 | 1 of 7See more | 8,496 |
| foundryvttgeek-cookbookVerified publisher | 3.4.2 | 1 of 1See more | 2,042 |
| ghostgeek-cookbookVerified publisher | 2.2.0 | 1 of 1See more | 4,260 |
| homebridgegeek-cookbookVerified publisher | 5.3.2 | 1 of 1See more | 15,653 |
| magic-mirrorgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 4,405 |
| overseerrgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 3,444 |
| sendgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,148 |
| tdarrgeek-cookbookVerified publisher | 4.6.2 | 1 of 2See more | 31,000 |
| uptime-kumageek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 5,079 |
| uptimerobotgeek-cookbookVerified publisher | 3.0.4 | 1 of 1See more | 1,669 |
| youtubedl-materialgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 4,410 |
| zigbee2mqttgeek-cookbookVerified publisher | 9.4.2 | 1 of 1See more | 2,173 |
| uptimekumahelm-l3st86Verified publisher | 0.1.10 | 1 of 1See more | 4,196 |
| openprojecthomeenterpriseinc | 0.5.0 | 1 of 1See more | 6,810 |
| pdc-portali4trustVerified publisher | 2.3.2 | 1 of 1See more | 2,723 |
| immichimmich-helm | 0.3.0 | 1 of 4See more | 15,712 |
| elasticinseefrlab | 2.2.0 | 1 of 2See more | 17,284 |
| todo-appjunktext-direct | 1.1.4 | 1 of 1See more | 3,369 |
| kenerkenerVerified publisher | 0.2.0 | 1 of 1See more | 5,228 |
| dashykrzwiatrzyk | 1.0.0 | 1 of 1See more | 3,143 |
| difykubeblocksVerified publisher | 0.5.1 | 2 of 5See more | 20,403 |
| kube-ingress-dash-chartkube-ingress-dashVerified publisher | 0.3.1 | 1 of 1See more | 1,505 |
| chibisafel4gVerified publisher | 0.1.1 | 2 of 3See more | 5,654 |
| lifecycle-jira-integrationlifecycle-jira-integration | 1.0.0 | 1 of 1See more | 927 |
| litellmlitellm-helm | 0.2.0 | 1 of 1See more | 4,292 |
| litlyxlitlyx | 0.2.0 | 3 of 5See more | 7,874 |
| jspolicyloftVerified publisher | 0.2.2 | 1 of 1See more | 2,309 |
| chatwootmaxcrm-chartsVerified publisher | 1.1.201 | 1 of 4See more | 5,940 |
| Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher | 1.0.1 | 2 of 6See more | 19,187 |
| food-managermoreillonVerified publisher | 0.5.0 | 1 of 2See more | 13,738 |
| tristian-idnonkronk | 0.1.3 | 1 of 1See more | 1,105 |
| oadaoadaVerified publisher | 5.0.5 | 10 of 11See more | 13,317 |
| dashdotoben01Verified publisher | 1.5.0 | 1 of 1See more | 1,238 |
| open5gs-webuiopen5gs-webuiVerified publisher | 2.3.1 | 1 of 2See more | 5,300 |
| open-api-discoveryopen-api-discoveryVerified publisher | 0.1.1 | 1 of 1See more | 2,473 |
| openccuopenccuVerified publisher | 3.89.8 | 1 of 1See more | 1,916 |
| openvaultopenvaultVerified publisher | 0.8.1 | 1 of 2See more | 6,873 |
| uptime-kumapascaliskeVerified publisher | 3.0.0 | 1 of 1See more | 6,883 |
| patchworkpatchworkVerified publisher | 0.8.6 | 1 of 2See more | 2,083 |
| pdf-editor-helmpdf-editor-web | 1.0.0 | 1 of 4See more | 4,206 |
| peertubepeertubeVerified publisher | 0.1.3 | 1 of 1See more | 7,035 |
| camophntom | 0.1.1 | 1 of 1See more | 1,217 |
| portraitportraitVerified publisher | 0.2.13 | 2 of 8See more | 31,844 |
| prowlerprowler-appVerified publisher | 0.0.9 | 1 of 5See more | 8,158 |
| psa-restricted-patcherpsa-restricted-patcherVerified publisher | 0.10.1 | 1 of 1See more | 1,401 |
Container images carrying it
798 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| moreillon/ | 0a8a7daf56f6 | tar | 7.5.3 | 1 |
| moreillon/ | d2ee0423b797 | tar | 7.5.3 | 1 |
| mozilla/ | 1da6ff5c4895 | tar | 7.5.3 | 1 |
| mpopoola1/ | 061fc532de7d | tar | 7.5.3 | 1 |
| muluder/ | 43b597a93da7 | tar | 7.5.3 | 1 |
| n8nio/ | 8b39ed5a2de9 | tar | 7.5.3 | 1 |
| n8nio/ | a9195bc499a3 | tar | 7.5.3 | 1 |
| n8nio/ | dd171d45102a | tar | 7.5.3 | 1 |
| neoskop/ | 7f52b5949f03 | tar | 7.5.3 | 1 |
| netrisai/ | 6e865080e86c | tar | 7.5.3 | 1 |
| nightscout/ | 00c3b4833f1b | tar | 7.5.3 | 1 |
| nightscout/ | ad29ca7a4de6 | tar | 7.5.3 | 1 |
| nightscout/ | f604dc4c03ca | tar | 7.5.3 | 1 |
| nocodb/ | 6779a4ddedf2 | tar | 7.5.3 | 1 |
| nocodb/ | d9516f0bf546 | tar | 7.5.3 | 1 |
| nodered/ | 216e7403aab9 | tar | 7.5.3 | 1 |
| nodered/ | d73ae167cb9b | tar | 7.5.3 | 1 |
| nodered/ | e131dcadfe92 | tar | 7.5.3 | 1 |
| nodered/ | e2632a7a35dd | tar | 7.5.3 | 1 |
| nodered/ | 070643219ea2 | tar | 7.5.3 | 1 |
| nonkronk/ | 0a3694d70647 | tar | 7.5.3 | 1 |
| nottiey/ | 9c35a24c9eb3 | tar | 7.5.3 | 1 |
| oada/ | c0d077e79ef4 | tar | 7.5.3 | 1 |
| oada/ | d87efe8ba4b0 | tar | 7.5.3 | 1 |
| oada/ | ebc8343f05ff | tar | 7.5.3 | 1 |
| oada/ | c6ffb4e8ed63 | tar | 7.5.3 | 1 |
| oada/ | fc09495e2f3c | tar | 7.5.3 | 1 |
| oada/ | b7a2cfc137cf | tar | 7.5.3 | 1 |
| oada/ | b6c562fa5b1b | tar | 7.5.3 | 1 |
| oada/ | 6590c60de347 | tar | 7.5.3 | 1 |
| oada/ | 7943fde43b19 | tar | 7.5.3 | 1 |
| oada/ | 8464c7f48aae | tar | 7.5.3 | 1 |
| obolnetwork/ | e263be0a7440 | tar | 7.5.3 | 1 |
| ohmyform/ | afe53f4acdb1 | tar | 7.5.3 | 1 |
| okaforuchena/ | 004e81250f48 | tar | 7.5.3 | 1 |
| omecproject/ | 5715e5648aa0 | tar | 7.5.3 | 1 |
| ondrejsika/ | b1fd497416c8 | tar | 7.5.3 | 1 |
| ooghenekaro/ | 03394ba1d6d8 | tar | 7.5.3 | 1 |
| ooghenekaro/ | d1f972aa844a | tar | 7.5.3 | 1 |
| ooghenekaro/ | ea5b71588a76 | tar | 7.5.3 | 1 |
| ooghenekaro/ | e010f5fecbc7 | tar | 7.5.3 | 1 |
| opea/ | 2bee4eb66f3e | tar | 7.5.3 | 1 |
| opea/ | 3ef121f34610 | tar | 7.5.3 | 1 |
| opea/ | 7f854e9bffaf | tar | 7.5.3 | 1 |
| openbas/ | a277796d9724 | tar | 7.5.3 | 1 |
| opendatacube/ | 80df355a660b | tar | 7.5.3 | 1 |
| openemr/ | 89eaa6d9a4e3 | tar | 7.5.3 | 1 |
| openhab/ | 29dd2bac8c4b | tar | 7.5.3 | 1 |
| openmined/ | d11524a3854a | tar | 7.5.3 | 1 |
| openproject/ | 734743d11094 | tar | 7.5.3 | 1 |