open-flaw/cve-2026-2395Proof-of-concept demonstrating a race condition in the tar npm package (v7.5.3) causing file collisions during parallel extraction, leading to data corruption or overwrite.
Proof of concept for CVE-2026-23950 - Race condition vulnerability in tar package.
This repository demonstrates a race condition vulnerability in the tar npm package (version 7.5.3) that allows for file collision during extraction. The vulnerability exploits Unicode normalization differences where collision_ss and collision_ß can be treated as the same file due to case-insensitive collisions.
The exploit creates a tar archive with two files:
collision_ss - containing 1000 'A' characterscollision_ß - containing 1000 'B' charactersWhen extracted with parallel processing enabled (jobs: 8), the race condition can cause these files to collide, resulting in:
npm install
node index.js
If the race condition is successfully exploited:
[*] GOODIf the vulnerability is not triggered:
[-] No collisionThis vulnerability could lead to:
Update to a patched version of the tar package when available.
This code is for educational and research purposes only. Do not use this exploit for malicious purposes.