CVE-2026-31802

The repository contains a functional proof-of-concept exploit for CVE-2026-31802, demonstrating a symlink path traversal vulnerability in the npm `tar` package. The exploit leverages a drive-relative symlink target to bypass validation and achieve arbitrary file overwrite outside the extraction directory.

The repository contains a functional proof-of-concept exploit for CVE-2026-31802, demonstrating a symlink path traversal vulnerability in the npm `tar` package. The exploit leverages inconsistent path sanitization to create a symlink outside the intended extraction directory, enabling arbitrary file overwrite.

This repository contains a scanner for detecting npm packages vulnerable to CVE-2026-31802, a path traversal vulnerability in the 'tar' npm package. It scans package-lock.json and node_modules for vulnerable versions and can test extraction behavior with crafted tar archives.

This script scans npm packages or tar/tgz files for path traversal vulnerabilities by checking for suspicious symlinks or path patterns. It does not exploit the vulnerability but detects potential indicators of CVE-2026-31802.

The repository contains a functional proof-of-concept exploit for CVE-2026-31802, demonstrating a path traversal vulnerability in the npm tar package via symbolic link manipulation. The PoC creates a malicious tar archive that overwrites files outside the intended extraction directory.

The repository claims to provide a PoC for CVE-2026-31802 (npm tar path traversal via symlinks) but contains no actual exploit code. Instead, it directs users to download an external `.exe` or `.zip` file from GitHub releases, which is a common tactic for distributing malware or fake exploits.