CVE-2026-29786
CVE Details
Visit the official vulnerability details page for CVE-2026-29786 to learn more.
Initial Publication
03/07/2026
Last Update
03/11/2026
Third Party Dependency
tar
NIST CVE Summary
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
CVE Severity
Our Official Summary
Investigation is ongoing to determine how this vulnerability affects our products.
Status
Analyzed
Affected Products & Versions
| Version | PaletteAI | PaletteAI VerteX |
|---|---|---|
| 1.0.7 | ⚠️ Impacted | ⚠️ Impacted |
Revision History
No revisions available.