Executive brief
The Rust 'tar' library, used for handling archive files, contains a logic error that causes it to process files differently than other common tools. This discrepancy allows an attacker to create a malicious archive that hides dangerous files (like symlinks to sensitive system data) from security scanners while still allowing them to be extracted by the application. This could lead to unauthorized access to sensitive files or system compromise if the library is used in automated deployment or package management systems.
Technical details
The tar-rs crate contains a logic error where it skips PAX (Portable Archive Exchange) size headers if the base header size is non-zero. This creates a differential parsing vulnerability when compared to other tar implementations (like Go's archive/tar or tokio-tar) which unconditionally honor PAX size overrides. An attacker can exploit this discrepancy to 'smuggle' entries, such as symlinks, into an archive. For example, a security scanner using one library might skip over a section of the archive it believes is part of a previous file's padding, while tar-rs (used by the actual extraction tool) would see and extract a malicious symlink. This is particularly impactful for ecosystems like crates.io and cargo that may use different underlying libraries for validation and extraction. The issue is fixed in version 0.4.45.
Affected products
- alexcrichton tar-rs <= 0.4.44
Timeline
- 2026-03-19: disclosed
- 2026-03-19: patched: Fixed in version 0.4.45
- 2026-03-20: advisory