Sploitus

Exploit for npm-tar-path-traversal-scanner

CVE-2026-31802

kitploit · 2026-09-08

Exploit Code

MARKDOWN25 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-RIDHINVA-NPM-TAR-PATH-TRAVERSAL-SCANNER
# CVE-2026-31802 — npm tar Path Traversal Scanner

Detects npm packages vulnerable to **CVE-2026-31802** , a path traversal vulnerability in the `tar` npm package that allows arbitrary file writes during archive extraction.

## Features

  * Scans `package-lock.json` for vulnerable `tar` versions
  * Checks `node_modules` for installed vulnerable packages
  * Tests extraction behavior with crafted tar archives
  * Identifies dependency chains leading to vulnerable `tar`
  * Supports bulk scanning of multiple projects
  * JSON/CSV report generation
  * Remediation recommendations



## Installation

root@kitploit:~
    
    
    git clone https://github.com/ridhinva/npm-tar-traversal-scanner.git
    cd npm-tar-traversal-scanner
    pip3 install -r requirements.txt