GHSA-xx64-wwv2-hcqq

Suggest an improvement
Source
https://github.com/advisories/GHSA-xx64-wwv2-hcqq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-xx64-wwv2-hcqq/GHSA-xx64-wwv2-hcqq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xx64-wwv2-hcqq
Aliases
Downstream
Related
Published
2026-05-06T17:26:38Z
Modified
2026-05-08T11:14:21.642308873Z
Severity
  • 2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
Details

Impact

In versions 0.6.0 and earlier of astral-tokio-tar, the unpack_in API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.

See GHSA-j4xf-2g29-59ph for the equivalent flaw in the tar crate.

Patches

Versions 0.6.1 and newer of astral-tokio-tar use fs::symlink_metdata rather than fs::metadata, avoiding the traversal.

Workarounds

Users are advised to upgrade to version 0.6.1 or newer to address this advisory.

Users should experience no breaking changes as a result of the patch above.

Resources

  • GHSA-j4xf-2g29-59ph for the original tar vulnerability

Attribution

  • Reporter: Adam Harvey (@lawngnome)
Database specific 
{
    "github_reviewed": true,
    "severity": "LOW",
    "github_reviewed_at": "2026-05-06T17:26:38Z",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-61"
    ]
}
References

Affected packages

crates.io / astral-tokio-tar

Package

Name
astral-tokio-tar
View open source insights on deps.dev
Purl
pkg:cargo/astral-tokio-tar

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.6.1

Database specific

last_known_affected_version_range 
"<= 0.6.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-xx64-wwv2-hcqq/GHSA-xx64-wwv2-hcqq.json"