crates.io/tar CVE-2021-38511: high 7.5, EPSS 1.39%

Links in archive can create arbitrary directories

Action: Upgrade tar to 0.4.36 or later.

cargo update -p tar --precise 0.4.36

Affected

Fixed versions

Sources

• osv: RUSTSEC-2021-0080
• https://crates.io/crates/tar
• https://rustsec.org/advisories/RUSTSEC-2021-0080.html
• https://github.com/alexcrichton/tar-rs/issues/238

CVE-2021-38511 · published 2021-07-19T12:00:00Z · modified 2026-07-17T16:00:04.671427235Z · JSON