Executive brief
astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
Affected products
- crates.io astral-tokio-tar
Junglewise Threat Intelligence
astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
Severity: medium · CVSS 4 · Published 2026-05-06
Technologies: astral-tokio-tar (crates.io). Vendors: crates.io.
Related threats
- astral-tokio-tar has a PAX Header Desynchronization issue
- Astral astral-tokio-tar PAX header desynchronization
- RUSTSEC-2026-0145 - PAX Header Desynchronization in astral-tokio-tar
- astral-tokio-tar is Vulnerable to PAX Header Desynchronization
- RUSTSEC-2026-0112 - PAX Header Desynchronization in astral-tokio-tar