TARmageddon Security Flaw in Rust Library Could Lead to Config Tampering and RCE

The article discusses a critical vulnerability named TARmageddon found in the async-tar Rust library and its forks, including tokio-tar. This vulnerability, assigned CVE-2025-62518, has a CVSS score of 8.1 and allows attackers to execute remote code by tampering with configuration files. The issue arises from a boundary-parsing bug that enables file smuggling, allowing malicious files to bypass security controls.

The vulnerability affects several major projects and is particularly concerning due to the abandonment of the popular tokio-tar fork, which complicates patching efforts. Users are advised to upgrade to patched versions or switch to actively maintained alternatives.