crates.io/astral-tokio-tar CVE-2025-59825: medium, EPSS 0.22%

astral-tokio-tar has a path traversal in tar extraction

Action: Upgrade astral-tokio-tar to 0.5.4 or later.

cargo update -p astral-tokio-tar --precise 0.5.4

Affected

Fixed versions

Sources

• osv: GHSA-3wgq-wrwc-vqmv
• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3wgq-wrwc-vqmv
• https://github.com/google/security-research/security/advisories/GHSA-9p78-p5g6-gcj8
• https://github.com/astral-sh/uv/issues/12163
• https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92dc9e02e9cef90684e75
• https://github.com/astral-sh/tokio-tar

CVE-2025-59825 · published 2025-09-23T17:45:07Z · modified 2025-11-18T16:40:30Z · JSON