High · published January 20, 2026
⚡ A sneaky race condition in node-tar allows attackers to exploit Unicode path collisions, paving the way for arbitrary file overwrites! Think of it as a restaurant where two chefs can prepare dishes for the same table at the same time, but one of them uses a name that sounds almost identical to the other. If they overlap, chaos ensues — orders get mixed up, and the diners might end up with something totally unexpected! An attacker could craft a malicious tar archive that tricks the system into processing two colliding paths at once, potentially overwriting critical files or injecting rogue scripts. This could lead to data loss or compromised systems for users on macOS with node-tar before version 7.5.4. Absolutely devastating for anyone relying on this library for file management!
Think of it as a restaurant where two chefs can prepare dishes for the same table at the same time, but one of them uses a name that sounds almost identical to the other. If they overlap, chaos ensues — orders get mixed up, and the diners might end up with something totally unexpected! This vulnerability manifests due to an incomplete handling of Unicode path collisions in the 'path-reservations' system, where the library fails to lock colliding paths on case-insensitive filesystems, allowing Symlink Poisoning attacks through race conditions.
An attacker could craft a malicious tar archive that tricks the system into processing two colliding paths at once, potentially overwriting critical files or injecting rogue scripts. This could lead to data loss or compromised systems for users on macOS with node-tar before version 7.5.4. Absolutely devastating for anyone relying on this library for file management! Upgrade node-tar to version 7.5.4 immediately to benefit from the patch. If upgrading isn't feasible right away, filter out all symbolic link entries when extracting tarball data as a temporary workaround. Stay vigilant! You've got this! With these steps, you'll be back in control and keeping your systems secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| isaacs/tar | < 7.5.4 | 7.5.4 |