TARmageddon flaw in Async-Tar Rust library allows to smuggle extra archives when the library is processing nested TAR files

According to CVE-2025-62518 (CVSS score: 8.1), TARmageddon is a flaw in the Rust async-tar library and forks like tokio-tar that could allow a remote attacker to achieve code execution. The vulnerability stems from a desynchronisation bug in how PAX and ustar headers are handled when processing archives with PAX-extended headers containing size overrides, enabling the smuggling of additional archive entries into an outer TAR.

The issue occurs when advancing by the ustar size (often zero) so the extractor fails to skip the nested archive’s data, causing inner headers to be interpreted as belonging to the outer archive. Versions of astral-tokio-tar prior to 0.5.6 contain this boundary parsing vulnerability, and exploitation can lead to file overwrites during extraction, supply-chain poisoning, and bypassing security scanners or bill-of-materials checks.

In practical scenarios, a malicious Python package or poisoned container image layers could trigger remote code execution during installation or deployment. The report emphasises that this is a logic bug in a parsing routine, not a memory-safety issue, and urges vigilance across languages and libraries.