A race condition exists in the path reservation system of node-tar that allows Unicode path collisions on case-insensitive, normalization-insensitive file systems such as macOS APFS. Because colliding names such as the German ß and the letters ss are treated as equivalent on such file systems, concurrent extraction of malicious entries bypasses the library’s internal locks and enables an attacker to create or overwrite arbitrary files. If the attacker succeeds, they could place a malicious executable in a location that the application later reads, potentially leading to integrity violations and possibly allowing arbitrary code execution depending on the application’s execution context.

The vulnerability affects Isaac’s node-tar library (used in Node.js) versions up through 7.5.3 when run on macOS operating systems that use APFS or HFS+ file systems. Users who extract tarballs with this library on those platforms are at risk.

A CVSS v3 score of 8.8 indicates high severity. The EPSS score is below 1 %, showing a very low but non‑zero exploitation probability, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The primary attack vector is the processing of a malicious tar archive by a system that uses node-tar for extraction, either locally or via a remote service that performs extraction on behalf of users. Successful exploitation requires that the target file system is case‑insensitive and normalizing‑insensitive; only then do the path collisions occur.