CVE-2026-24842

HIGH

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Details

CVSS v3: 8.2
NVD published: 2026-01-28 01:16:14
EPSS: <0.1% probability · 4.6th percentile — 2026-03-30
Affected versions: cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*
Summary: node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
Remediation: Not available in our cache.
Exploit info: https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v

TopVuln sends digest emails with high-risk CVE picks across multiple authoritative sources—curated with EPSS and AI. Choose daily per-stream emails and optional weekly or monthly roundups.

Subscribe — free email digest or paid plan

Information is aggregated from multiple authoritative sources for convenience; verify with NVD and vendors before operational decisions.