CVE-2026-23950
Race Condition in node-tar Allows Symlink Poisoning on macOS
Publication date: 2026-01-20
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| isaacs | tar | to 7.5.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-176 | The product does not properly handle when an input contains Unicode encoding. |
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in node-tar (versions up to 7.5.3) is a race condition caused by improper handling of Unicode path collisions on case-insensitive or normalization-insensitive filesystems like macOS APFS. The library's PathReservations system, which is supposed to serialize file operations on the same path to prevent conflicts, fails to properly lock paths that appear different under Unicode normalization but collide on the filesystem (e.g., 'ß' and 'ss'). This allows parallel processing of colliding paths, bypassing concurrency safeguards and enabling Symlink Poisoning attacks and arbitrary file overwrites during tarball extraction. [1]
How can this vulnerability impact me? :
The vulnerability can lead to arbitrary file overwrites and Symlink Poisoning attacks during extraction of malicious tar archives. This means an attacker can exploit the race condition to overwrite or create files they should not have access to, potentially leading to unauthorized code execution, data corruption, or system compromise on affected systems using node-tar on macOS filesystems. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying usage of node-tar versions up to and including 7.5.3 on macOS systems using APFS or HFS+ filesystems, especially when extracting tarballs containing symbolic links or filenames with Unicode ligatures that may cause path collisions (e.g., 'ß' and 'ss'). While no specific commands are provided in the resources, users should audit their systems for node-tar package versions and monitor extraction processes for suspicious parallel processing of colliding paths or unexpected file overwrites. Filtering out symbolic link entries during extraction can also help detect attempts to exploit this issue. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading node-tar to version 7.5.4 or later, which contains the patch that improves Unicode normalization and path reservation handling to prevent this race condition. If upgrading promptly is not possible, users should programmatically filter out all symbolic link entries during tarball extraction to prevent arbitrary file writes via filename collisions, as done by npm. These steps reduce the risk of Symlink Poisoning and arbitrary file overwrite attacks on affected macOS filesystems. [1]