GHSA-fp55-jw48-c537 astral-tokio-tar is Vulnerable to PAX Header Desynchronization
Attackers can smuggle unexpected files onto a victim's filesystem by exploiting PAX header desynchronization in the astral-tokio-tar library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-fp55-jw48-c537?
GHSA-fp55-jw48-c537 is a path traversal vulnerability in astral-tokio-tar, published on 27 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.
Patches
Versions 0.6.1 and newer of astral-tokio-tar address this differential.
Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
There is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.
Resources
- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug
Attribution
- Reporter: Adam Harvey (@lawngnome)
Which versions are affected by GHSA-fp55-jw48-c537?
3 open source packages ship an affected version, including astral-tokio-tar.
| Package | Affected | Fixed in |
|---|---|---|
astral-tokio-tar crates.io | All versions | 0.6.1 |
astral-tokio-tar crates.io | All versions | 0.6.1 |
astral-tokio-tar crates.io | From 0.0.0-0 | 0.6.1 |
How do I fix GHSA-fp55-jw48-c537?
Upgrade astral-tokio-tar to 0.6.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-fp55-jw48-c537 being exploited?
There is no known exploitation of GHSA-fp55-jw48-c537 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0112.