RUSTSEC-2026-0145

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0145

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0145.json

JSON Data

https://api.test.osv.dev/v1/vulns/RUSTSEC-2026-0145

Aliases

GHSA-3cv2-h65g-fgmm

Published

2026-05-18T12:00:00Z

Modified

2026-05-19T05:00:03.978032742Z

Summary

PAX Header Desynchronization in astral-tokio-tar

Details

Versions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / astral-tokio-tar

Package

Name: astral-tokio-tar; View open source insights on deps.dev
Purl: pkg:cargo/astral-tokio-tar

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.6.2

Ecosystem specific

{
    "affects": {
        "arch": [],
        "os": [],
        "functions": []
    },
    "affected_functions": null
}