astral-tokio-tar CVE-2025-62518

Exploitation requires that an application using astral-tokio-tar <= 0.5.5 (or the related tokio-tar <= 0.3.1) parse/extract an attacker-supplied tar archive; the archive must contain a PAX-extended header with a size override (e.g. size=1048576) paired with a ustar header size of zero, and file data that begins with valid tar header structures. The key limiting factor is UI:R - a victim or automated pipeline must actually process the untrusted archive; there is no authentication requirement (PR:N). The vendor states there are no workarounds and no mitigating configuration, so any default use of a vulnerable version against untrusted input is exposed; the realistic blast radius is largest in automated ingestion paths such as package installers (e.g. uv) that unpack remote archives.

Signals are moderately aligned toward a real but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High) indicates a network-delivered, low-complexity, unauthenticated flaw whose only gating factor is user/application interaction (UI:R) - a victim must extract an attacker-supplied archive. CWE-843 (type/entry confusion via PAX/ustar desynchronization) and the GHSA description support high confidentiality and integrity impact (attacker-controlled filesystem access, potential code execution or credential exfiltration) with no direct availability impact, consistent with A:N. Counterbalancing this, EPSS is only 0.70% (52nd percentile), there is no CISA KEV listing, and no public exploit is identified in the provided data (only the vendor patch commit and a regression test), so there is no evidence of active or at-scale exploitation. The 'Memory Corruption' tag is misleading: this is a safe-Rust parsing-logic desync, not a memory-safety bug, so the real impact is archive entry smuggling rather than memory corruption. Net: a genuine high-severity supply-chain parsing flaw that matters most where the library extracts untrusted archives (notably Astral's uv), but current exploitation probability is low and interaction-dependent rather than wormable.

An attacker crafts a malicious tar archive whose outer entry carries a PAX extended header declaring size=N while the ustar header declares size=0, with the file body beginning with valid tar header bytes; a victim application built on astral-tokio-tar (e.g. via uv) extracts this untrusted archive. The parser advances by the ustar size (0 bytes) instead of the PAX size, so smuggled inner content is reinterpreted as additional legitimate archive entries and written to the filesystem. No public exploit code is identified in the provided data, but the patch commit and the regression test (pax-header-precedence.tar) demonstrate the exact trigger, and exploitation requires that the victim process the attacker's archive (UI:R).