CVE-2026-23950
📋 TL;DR
node-tar versions up to 7.5.3 have a race condition vulnerability that allows arbitrary file overwrite via symlink poisoning attacks. This occurs when extracting malicious tar archives on case-insensitive filesystems like macOS APFS/HFS+ due to Unicode path collision handling issues. Users extracting untrusted tar archives on affected systems are at risk.
💻 Affected Systems
- node-tar
📦 What is this software?
Tar by Isaacs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file overwrite leading to privilege escalation, data destruction, or remote code execution.
Likely Case
Local privilege escalation or data corruption when extracting malicious tar archives from untrusted sources.
If Mitigated
Limited impact if only extracting trusted archives or using workarounds like symbolic link filtering.
🎯 Exploit Status
Exploitation requires crafting malicious tar archives with Unicode path collisions and requires the target to extract them on vulnerable filesystems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.5.4
Vendor Advisory: https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
Restart Required: No
Instructions:
1. Update node-tar to version 7.5.4 or later using npm: npm update tar 2. Verify the update with: npm list tar
🔧 Temporary Workarounds
Filter symbolic links during extraction
allFilter out all symbolic link entries when extracting untrusted tar archives, similar to npm's approach
Implement custom extraction logic that filters entries with type 'SymbolicLink' before processing
🧯 If You Can't Patch
- Avoid extracting untrusted tar archives on macOS APFS/HFS+ filesystems
- Implement strict input validation and sanitization for tar archive processing
🔍 How to Verify
Check if Vulnerable:
Check node-tar version with: npm list tar | grep tarCheck Version:
npm list tar | grep tarVerify Fix Applied:
Verify version is 7.5.4 or higher: npm list tar | grep -E 'tar@(7\.5\.[4-9]|[8-9]|\d{2,})'📡 Detection & Monitoring
Log Indicators:
- Multiple file operations on similar Unicode paths (e.g., ß and ss)
- Unexpected symbolic link creation during tar extraction
Network Indicators:
- Large number of tar archive uploads to vulnerable endpoints
SIEM Query:
Process execution logs showing tar extraction with Unicode filenames on macOS systems