CLEANSTART-2026-HZ58373: node-tar is a Tar for Node

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates an attacker needs local access and no privileges, but exploitation requires user interaction.

Q: What is the expected security impact?

The vulnerability is rated high with a CVSS score of 8.2. It may result in high confidentiality impact and low integrity impact; no availability impact is indicated.

Published Nov 5, 2026

Updated

Security vulnerability affects the npm package. node-tar is a Tar for Node.

Affected Software

1 affected componentFixes available

cleanstart/npm<10.9.2-r1

10.9.2-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 10.9.2-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·06:31 AM

Data Sourced

via OSV·06:31 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-23745

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates an attacker needs local access and no privileges, but exploitation requires user interaction.

What is the expected security impact?

The vulnerability is rated high with a CVSS score of 8.2. It may result in high confidentiality impact and low integrity impact; no availability impact is indicated.

CLEANSTART-2026-HZ58373: node-tar is a Tar for Node

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?