app-builder CVE-2026-13723

Exploitation requires macOS with an APFS or HFS+ filesystem - the Unicode case-folding collision (ß ↔ ss) is specific to Apple's filesystem implementations and does not occur on Linux (ext4, btrfs, xfs) or Windows (NTFS); non-macOS deployments are completely unaffected. The app-builder process must be induced to extract a ZIP archive that the attacker has crafted or tampered with; in typical Electron CI pipelines this occurs when app-builder downloads platform-specific electron binaries or other build assets from a remote source. The CVSS vector (PR:N, UI:N) indicates no authentication or user interaction is required from the attacker's perspective - delivery of the malicious archive to the extraction routine is sufficient. Exploitation is bounded by the filesystem permissions of the account running app-builder: it cannot escalate privileges beyond that account's existing write access, and cannot affect files outside that account's write scope.

The NVD CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects low attack complexity and no authentication requirement but scores integrity impact as Low, which likely underestimates real-world impact: the ability to overwrite arbitrary files accessible to the app-builder process - including CI runner SSH keys, signing certificates, or application binaries - warrants consideration of I:H. EPSS data was not provided, so probabilistic exploitation comparison cannot be made. SSVC signals are partly reassuring (exploitation: none) but the automatable rating means a supply-chain attacker could deliver malicious archives at scale without manual steps. The macOS APFS dependency is a meaningful constraint: Linux (ext4/btrfs) and Windows (NTFS) build environments are entirely unaffected, narrowing the exposed population to macOS-based Electron CI pipelines. CERT/CC and ENISA coordinated disclosure, combined with a targeted test case in the fix PR, confirm the mechanism is well understood. The absence of a KEV listing and public POC reduces urgency but does not eliminate risk given automated delivery feasibility.

An attacker with write access to an artifact mirror, CDN, or package registry serving ZIPs consumed by app-builder - such as a compromised electron binary distribution endpoint - delivers a crafted archive embedding a symlink entry ss pointing to a high-value target (for example, a CI runner's SSH private key or a code-signing certificate) followed by a regular-file entry ß containing attacker-controlled content. When app-builder processes the archive on a macOS APFS build host, APFS folds ß onto the existing ss directory entry, and without O_NOFOLLOW the write silently follows the symlink to overwrite the target outside the extraction directory. No public proof-of-concept is identified at time of analysis, though the regression test in PR #163 reproduces the exact scenario and confirms the attack geometry.