Reported

April 27, 2026

Issued

April 28, 2026

Package

astral-tokio-tar (crates.io)

Type

Vulnerability

Categories

• format-injection

Keywords

#parser-differential #smuggling

Aliases

• GHSA-fp55-jw48-c537

References

• https://github.com/advisories/GHSA-fp55-jw48-c537

Patched

• >=0.6.1

Description

Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.

Advisory available under CC0-1.0 license.