Versions of astral-tokio-tar prior to 0.6.1 have a PAX header interpretation bug that causes desynchronization during extraction. This allows manipulated archive entries to be selectively visible or invisible depending on the tar implementation used, enabling attackers to smuggle unexpected files onto a victim's filesystem. The issue is fixed in version 0.6.1, and upgrading is the only recommended mitigation.