CVE-2025-46394

What it actually does

BusyBox tar fails to sanitize or escape terminal control sequences in archive member names, allowing filenames to contain sequences that manipulate terminal output during listing operations and conceal selected entries.

Why it matters to the business

Organizations distributing or inspecting software via BusyBox tar may unknowingly process archives containing concealed files, increasing the risk of undetected tampering or inclusion of unwanted content in build pipelines and embedded systems.

How an attack unfolds

An attacker creates a TAR archive containing filenames that embed ANSI escape sequences designed to overwrite or hide subsequent lines when the archive is listed with BusyBox tar; the hidden entries can then carry malicious payloads that remain invisible during routine inspection.

How to fix it

Upgrade BusyBox to a version newer than 1.37.0 once a fix is released; until then, replace BusyBox tar with GNU tar or another implementation that properly handles terminal sequences for archive operations.

How to confirm the fix worked

Test tar listings against archives containing filenames with embedded escape sequences and confirm that all member names remain fully visible; verify BusyBox version and compare output against a reference implementation such as GNU tar.

Typical attack path

1. Craft TAR archive with member names containing terminal escape sequences
2. Distribute or substitute the archive in a supply chain or download location
3. Victim uses BusyBox tar to list or extract contents
4. Escape sequences alter terminal rendering to conceal malicious member names
5. Hidden files are processed or executed without user awareness

How to detect it

Search logs and forensic images for tar processes invoked with listing options on archives whose member names contain terminal escape sequences; examine package build artifacts and downloaded tarballs for filenames embedding control characters.

What your security team should do

• Identify all systems using BusyBox tar for archive handling and prioritize upgrade
• Introduce policy requiring GNU tar or equivalent for security-sensitive archive inspection
• Add archive scanning steps that detect and flag control characters in filenames before extraction