Threats affecting pkg:cargo/astral-tokio-tar

The Rust crate `astral-tokio-tar` has been officially unmaintained since November 3, 2026. All versions of this crate are deprecated and no longer receive updates or security patches. Users are advised to migrate to the recommended alternative crate `tar-codec` for strict tar encoding and decoding functionality.

In astral-tokio-tar versions 0.6.0 and earlier, the unpack_in API could change permissions of directories outside the intended archive by following symlinks. This vulnerability allows a crafted tar archive to modify external directory permissions but does not affect individual file permissions. The issue is fixed in version 0.6.1, which changes the method used to avoid symlink traversal.

Versions of astral-tokio-tar prior to 0.6.1 have a PAX header interpretation bug that causes desynchronization during extraction. This allows manipulated archive entries to be selectively visible or invisible depending on the tar implementation used, enabling attackers to smuggle unexpected files onto a victim's filesystem. The issue is fixed in version 0.6.1, and upgrading is the only recommended mitigation.