Cybersecurity researchers have detailed a high-severity flaw affecting the popular async-tar Rust library and its forks, including tokio-tar. This flaw could allow remote code execution under certain conditions.
The vulnerability, tracked as CVE-2025-62518 (CVSS score: 8.1), was codenamed TARmageddon by Edera, which discovered the issue in late August 2025. This vulnerability affects several widely used projects, including testcontainers and wasmCloud.
“In the worst-case scenario, this vulnerability has a severity rating of 8.1 (High) and could lead to remote code execution (RCE) through file overwrite attacks such as configuration file replacement or build backend hijacking,” the Seattle-based security firm said.
The problem is further complicated by the fact that tokio-tar is essentially abandonware, despite attracting thousands of downloads via crates.io. Tokio-tar is a Rust library for asynchronously reading and writing TAR archives built on the Tokio runtime programming language. The Rust crate was last updated on July 15, 2023.
In the absence of a patch for tokio-tar, users of this library are encouraged to migrate to astral-tokio-tar, version 0.5.6 has been released to fix a defect.
“Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows an attacker to exploit inconsistent PAX/ustar header handling to smuggle additional archive entries,” Astral developer William Woodruff said in a warning.
“When processing an archive containing a PAX extension header with a size override, the parser incorrectly advances the stream position based on the ustar header size (often zero) rather than the PAX-specified size, interpreting the file content as a legitimate TAR header.”
This issue is simply the result of inconsistent handling of PAX extension headers and ustar headers when determining file data boundaries. PAX stands for Portable Archive Interchange and is an enhanced version of the USTAR format used to store properties of member files in TAR archives.
A mismatch between the PAX extension header and the ustar header, where the PAX header correctly specifies the file size, but the ustar header incorrectly specifies the file size as zero (rather than the PAX size), causes a parsing mismatch that causes the library to interpret internal content as additional external archive entries.
“Advancing by 0 bytes prevents the parser from skipping the actual file data (the nested TAR archive) and immediately encounters the next valid TAR header at the beginning of the nested archive,” Edera explained. “The internal archive’s header is then incorrectly interpreted as a legitimate entry belonging to the external archive.”
As a result, an attacker could exploit this behavior to “smuggle” additional archives when the library is processing nested TAR files, thereby overwriting files in the extraction directory, potentially paving the way to arbitrary code execution.
In a hypothetical attack scenario, an attacker could upload a specially crafted package to PyPI such that the outer TAR contains a legitimate pyproject.toml while the hidden inner TAR contains something malicious that hijacks the build backend and overwrites the real files during installation.
“Rust’s guarantees make it much harder to introduce memory safety bugs (like buffer overflows and use-after-free), but they don’t eliminate logic bugs. And this parsing discrepancy is fundamentally a logic flaw,” Edera said. “Developers must remain vigilant against all classes of vulnerabilities, regardless of the language used.”
Source link
