Fix CVE-2026-26960: Upgrade tar to patch hardlink vulnerability#2318
Fix CVE-2026-26960: Upgrade tar to patch hardlink vulnerability#2318JanPokorny wants to merge 1 commit intomainfrom
Conversation
Add pnpm workspace override to force tar >= 7.5.8 for all transitive dependencies, addressing the arbitrary file read/write vulnerability (GHSA-83g3-92jg-28cx) introduced via hardlink target escape through symlink chains during tar extraction. Affected transitive path: mintlify -> @mintlify/previewing -> tar@6.1.15 https://claude.ai/code/session_017BS2GycsLy1vkft6LFA3vS
dosubot
bot
added
the
size:XS
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a critical security update by upgrading a core dependency, Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly upgrades the tar package to version 7.5.8 to address the security vulnerability GHSA-83g3-92jg-28cx. The use of pnpm overrides is appropriate for forcing the version of a transitive dependency. I have a couple of suggestions to improve the clarity and focus of this change. First, the comment in pnpm-workspace.yaml contains an incorrect CVE number and a misleading description of the vulnerability; I've suggested a correction. Second, the pnpm-lock.yaml file includes an update to @carbon/react which seems unrelated to the tar security fix. It's a good practice to keep dependency updates in separate, focused pull requests.
| '@carbon/react': | ||
| specifier: ^1.101.0 | ||
| version: 1.101.0 | ||
| version: 1.102.0 |
There was a problem hiding this comment.
This pull request is focused on a security upgrade for the tar package. However, it also includes an update for @carbon/react from 1.101.0 to 1.102.0. To maintain a clean and focused commit history, it's best to keep unrelated dependency updates in separate pull requests. This makes it easier to track changes and revert them if necessary. Could you please revert this specific change and address it in a separate PR?
| # Fix CVE-2026-26960 / GHSA-83g3-92jg-28cx: Arbitrary File Read/Write via Hardlink Target Escape | ||
| # Transitive via mintlify -> @mintlify/previewing -> tar@6.1.15 | ||
| "tar@<7.5.8": "7.5.8" |
There was a problem hiding this comment.
The CVE number and vulnerability description in the comment seem incorrect. CVE-2026-26960 appears to be a typo, and as of now, GHSA-83g3-92jg-28cx does not have a CVE assigned. Also, the vulnerability description for this GHSA is "Arbitrary File Creation/Overwrite on Windows via Specially-Crafted TAR File", not related to hardlink escapes. To avoid confusion, I suggest updating the comment to accurately reflect the vulnerability being addressed.
# Fix GHSA-83g3-92jg-28cx: Arbitrary File Creation/Overwrite on Windows via Specially-Crafted TAR File
# Transitive via mintlify -> @mintlify/previewing -> tar@6.1.15
"tar@<7.5.8": "7.5.8"
2 participants
Summary
Upgrades the
tarpackage to version 7.5.8 to fix CVE-2026-26960 / GHSA-83g3-92jg-28cx, which addresses an arbitrary file read/write vulnerability via hardlink target escape. This dependency is transitive via mintlify → @mintlify/previewing → tar@6.1.15.Linked Issues
Documentation
https://claude.ai/code/session_017BS2GycsLy1vkft6LFA3vS