RUSTSEC-2026-0113
NoneCVSS
—
EPSS
—
Published
Apr 27, 2026
CISA due date
—
The record
`unpack_in` can chmod arbitrary directories by following symlinks
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | astral-tokio-tar | 0 | 0.6.1 |
| crates.io | astral-tokio-tar | 0.0.0-0 | 0.6.1 |
Related vulnerabilities
- RUSTSEC-2026-0145 PAX Header Desynchronization in astral-tokio-tar Also affects astral-tokio-tar
- RUSTSEC-2026-0112 PAX Header Desynchronization in astral-tokio-tar Also affects astral-tokio-tar
- CVE-2026-32766 astral-tokio-tar is a tar archive reading/writing library for async Rust. Also affects astral-tokio-tar
- RUSTSEC-2026-0066 Insufficient validation of PAX extensions during extraction Also affects astral-tokio-tar
- CVE-2025-62518 astral-tokio-tar is a tar archive reading/writing library for async Rust. Also affects astral-tokio-tar