A critical boundary parsing vulnerability in the astral-sh tokio-tar library allows unauthenticated attackers to perform malicious archive entry smuggling.

This vulnerability involves a type confusion flaw (CWE-843) where the library incorrectly handles PAX-extended headers. An unauthenticated attacker can exploit this inconsistency to force the parser to misinterpret file content as legitimate tar headers, effectively bypassing security boundaries.

The ability to smuggle archive entries poses a significant risk to data integrity and system security. Successful exploitation could allow an attacker to write arbitrary files or manipulate system state, leading to unauthorized access or potential compromise of the host environment. With a CVSS score of 8.1, this represents a high-severity risk that demands immediate attention to prevent malicious file injection.

Immediate Action: Update the astral-sh tokio-tar crate to version 0.5.6 or higher immediately to incorporate the necessary boundary parsing patches.

Proactive Monitoring: Review application logs for anomalous archive processing patterns or unexpected file creation events following the extraction of untrusted tar files.

Compensating Controls: Implement strict input validation and sanitization for all archive files before they are processed by the library to identify and reject malformed headers.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the edera-dev/cve-tarmageddon repository.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations utilizing the tokio-tar library must prioritize updating to version 0.5.6 to neutralize this boundary parsing flaw. Failure to patch may allow attackers to execute arbitrary file operations, posing a severe threat to the integrity of the affected Rust-based applications.