{"id":"GHSA-xx64-wwv2-hcqq","revision":"61fc9ea590404d0187973d82ccde9c2e","records":[{"revision":"61fc9ea590404d0187973d82ccde9c2e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-xx64-wwv2-hcqq","aliases":["RUSTSEC-2026-0113"],"title":"astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks","description":"### Impact\n\nIn versions 0.6.0 and earlier of astral-tokio-tar, the `unpack_in` API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.\n\nSee GHSA-j4xf-2g29-59ph for the equivalent flaw in the `tar` crate.\n\n### Patches\n\nVersions 0.6.1 and newer of astral-tokio-tar use `fs::symlink_metdata` rather than `fs::metadata`, avoiding the traversal. \n\n### Workarounds\n\nUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.\n\nUsers should experience no breaking changes as a result of the patch above.\n\n### Resources\n\n- GHSA-j4xf-2g29-59ph for the original `tar` vulnerability\n\n### Attribution\n\n- Reporter: Adam Harvey (@lawngnome)","state":0,"publishedAt":"2026-05-06T17:26:38+00:00","modifiedAt":"2026-09-10T03:51:07.3017975+00:00","affected":[{"ecosystem":"crates.io","name":"astral-tokio-tar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.6.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-xx64-wwv2-hcqq","https://github.com/advisories/GHSA-xx64-wwv2-hcqq","https://github.com/astral-sh/tokio-tar","https://rustsec.org/advisories/RUSTSEC-2026-0113.html"],"sourceUrl":"https://github.com/advisories/GHSA-xx64-wwv2-hcqq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xx64-wwv2-hcqq","identifiers":["GHSA-xx64-wwv2-hcqq","RUSTSEC-2026-0113"]},"retained":false,"historicalAffected":[]}],"coverage":[]}