CVE-2026-31802

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Node.js script (poc.cjs) that programmatically creates a tar archive with a drive-relative symlink (C:../../../target.txt) and then extracts it using the vulnerable tar.x() function, demonstrating file overwrite outside the extraction directory. The accompanying README.md describes the vulnerability and provides instructions for downloading and running a pre-built executable, but the included script itself is a functional exploit.

Backdoor review

Suspicious behavior

The README.md instructs the operator to download and execute an external binary from a third-party repository, while the included poc.cjs is a legitimate local PoC script. The README's instructions materially contradict the disclosed CVE context by directing the user to an unrelated executable, creating a deceptive lure.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesJavaScript
Target softwarenode-tar
Attack typespath traversalsymlink attack
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file poc.cjs contains executable code that actively exploits CVE-2026-31802 by crafting a malicious tar archive and extracting it to overwrite a file outside the intended directory. This is code intended to exercise a vulnerability, not merely detect it.

Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:1-23

Requirements

  • Node.js runtime with the 'tar' npm package installed (version < 7.5.11)Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:1-3
  • Write access to the current working directory and its parent directoryRecorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:5-9

Observed behavior

  • Creates a file 'target.txt' in the parent directory with content 'ORIGINAL'Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:9
  • Constructs a tar header with a symbolic link entry pointing to 'C:../../../target.txt'Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:11-16
  • Writes the crafted tar archive to 'poc.tar'Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:18
  • Extracts the tar archive using tar.x(), which follows the symlink and writes outside the extraction directoryRecorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:20
  • Overwrites the symlink target with 'PWNED' and prints the content of the overwritten file to stdoutRecorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:21-22
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Deceptive Lure
  • The README.md presents itself as a PoC for CVE-2026-31802 but instructs the user to download and run an external .exe or .zip file from a different GitHub repository (Recorded-texteditor120/CVE-2026-31802). The actual PoC code (poc.cjs) is a local Node.js script and does not require any external download. This misdirection conceals the true nature of the downloaded executable.Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:3Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:35Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:43Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:55-59

Observables

Url
https://github.com/Recorded-texteditor120/CVE-2026-31802/releasesExternal download link for an unreviewed executable, presented as the primary way to use the PoC.Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:3
File
poc.cjsLegitimate local PoC script that creates a tar archive with a drive-relative symlink to demonstrate CVE-2026-31802.Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:1-23
Review boundaries

What the analysis did not establish

  • The README.md references an external pre-built executable on a third-party releases page, which is not included in the evidence and cannot be analyzed.
  • The evidence does not confirm whether the included poc.cjs script was executed or whether it functions as described.
  • The external executable referenced in the README is not included in the evidence and cannot be analyzed.
  • The review cannot determine if the external repository is controlled by the same author or if the executable is harmful.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1