{"id":"RUSTSEC-2026-0145","aliases":["GHSA-3cv2-h65g-fgmm"],"title":"PAX Header Desynchronization in astral-tokio-tar","summary":"PAX Header Desynchronization in astral-tokio-tar","severity":"none","vendor":"astral-tokio-tar","product":"astral-tokio-tar","ecosystem":"rust","affected":["astral-tokio-tar >= 0.0.0-0, < 0.6.2"],"patched":["astral-tokio-tar 0.6.2"],"published":"2026-05-18","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:08.332832886Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0145","references":[{"url":"https://crates.io/crates/astral-tokio-tar"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0145.html"},{"url":"https://github.com/astral-sh/tokio-tar/pull/82"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.193Z","slug":"RUSTSEC-2026-0145","body":"## Overview\n\nVersions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.\n\n## Affected packages\n\n- `astral-tokio-tar >= 0.0.0-0, < 0.6.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `astral-tokio-tar 0.6.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}