CLEANSTART-2026-DF21516: node-tar is a full-featured Tar for Node

Q: What access and conditions does an attacker need to exploit this issue?

The supplied CVSS vector indicates local access, low attack complexity, no required privileges, and required user interaction. It does not describe the specific user action or local attack path involved.

Q: What is the expected security impact if exploitation succeeds?

The CVSS vector rates confidentiality and integrity impact as high, with no availability impact. The impact is within the vulnerable component's existing security authority (scope unchanged).

Q: Can I determine whether my environment is affected from this advisory?

Not conclusively. The provided data identifies the npm package as node-tar but does not include affected or fixed versions, configuration prerequisites, indicators of compromise, or detection steps.

Published Nov 5, 2026

Updated

Security vulnerability affects the npm package. node-tar is a full-featured Tar for Node.

Affected Software

1 affected componentFixes available

cleanstart/npm<10.9.2-r1

10.9.2-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 10.9.2-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·06:32 AM

Data Sourced

via OSV·06:32 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-26960

Frequently Asked Questions

What access and conditions does an attacker need to exploit this issue?

The supplied CVSS vector indicates local access, low attack complexity, no required privileges, and required user interaction. It does not describe the specific user action or local attack path involved.

What is the expected security impact if exploitation succeeds?

The CVSS vector rates confidentiality and integrity impact as high, with no availability impact. The impact is within the vulnerable component's existing security authority (scope unchanged).

Can I determine whether my environment is affected from this advisory?

Not conclusively. The provided data identifies the npm package as node-tar but does not include affected or fixed versions, configuration prerequisites, indicators of compromise, or detection steps.

CLEANSTART-2026-DF21516: node-tar is a full-featured Tar for Node

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access and conditions does an attacker need to exploit this issue?

What is the expected security impact if exploitation succeeds?

Can I determine whether my environment is affected from this advisory?

Company

Resources

Contact

Frequently Asked Questions

What access and conditions does an attacker need to exploit this issue?

What is the expected security impact if exploitation succeeds?

Can I determine whether my environment is affected from this advisory?