TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution

Cybersecurity researchers have disclosed a high-severity flaw in the async-tar Rust library and its forks, including tokio-tar, that could allow remote code execution under certain conditions, tracked as CVE-2025-62518 (CVSS 8.1) and codenamed TARmageddon by Edera. The vulnerability affects several widely-used projects, such as testcontainers and wasmCloud, and exists because tokio-tar is effectively abandonware with its last update in July 2023.

In the absence of a patch, users are advised to migrate to astral-tokio-tar, which released version 0.5.6 to remediate the flaw, following a boundary parsing issue with PAX/ustar headers that can smuggle extra archive entries. Astral’s warning explains that, when processing archives with PAX-extended headers containing size overrides, the parser may advance zero bytes instead of the PAX-specified size, causing the inner archive to be misinterpreted as part of the outer one.

This could enable an attacker to overwrite files in extraction directories or, in a worst-case scenario, achieve arbitrary code execution, highlighting a logic flaw despite Rust’s memory-safety guarantees. The article notes that a hypothetical attack could involve crafting a PyPI package to exploit nested TARs, and stresses the need for vigilance from developers.