Is CVE-2026-26960 actively exploited?

No active exploitation of CVE-2026-26960 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26960 be exploited remotely?

No. CVE-2026-26960 requires local access to exploit.

What is the CVSS score of CVE-2026-26960?

CVE-2026-26960 has a CVSS score of 7.1 (HIGH) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2026-26960

HIGH

CVE-2026-26960

CWE-22Published: February 20, 2026· Updated: Feb 20, 2026

7.1

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.2th

Official Description

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

NVD Source

Technical Analysis

CVE-2026-26960 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.1.