Executive brief
`unpack_in` can chmod arbitrary directories by following symlinks
Affected products
- crates.io astral-tokio-tar
Junglewise Threat Intelligence
RUSTSEC-2026-0113 - `unpack_in` can chmod arbitrary directories by following symlinks
Severity: info ยท Published 2026-04-27
Technologies: astral-tokio-tar (crates.io). Vendors: crates.io.
Related threats
- astral-tokio-tar has a PAX Header Desynchronization issue
- Astral astral-tokio-tar PAX header desynchronization
- RUSTSEC-2026-0145 - PAX Header Desynchronization in astral-tokio-tar
- astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
- astral-tokio-tar is Vulnerable to PAX Header Desynchronization