{"action":"Upgrade async-tar to 0.6.1 or later.","affected":[{"fixed":"0.6.1","introduced":"0"}],"component":"async-tar","cve_ids":["CVE-2026-53600"],"ecosystem":"crates.io","epss":0.00445,"exploited":false,"fixed_versions":["0.6.1"],"ghsa_id":"GHSA-35rm-7j9c-2f7m","id":"tcs_01M5KERQNR3P10QHEYKE0VDZN2","modified_at":"2026-09-10T03:50:51.346352208Z","published_at":"2026-07-08T20:24:12Z","references":["https://osv.dev/vulnerability/GHSA-35rm-7j9c-2f7m","https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m","https://github.com/dignifiedquire/async-tar"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-35rm-7j9c-2f7m","url":"https://osv.dev/vulnerability/GHSA-35rm-7j9c-2f7m"},{"source":"nvd","source_id":"CVE-2026-53600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53600"}],"summary":"async-tar PAX extension-header desync enables tar entry/content smuggling"}