{"action":"Upgrade astral-tokio-tar to 0.5.4 or later.","affected":[{"fixed":"0.5.4","introduced":"0"}],"component":"astral-tokio-tar","cve_ids":["CVE-2025-59825"],"ecosystem":"crates.io","epss":0.00217,"exploited":false,"fixed_versions":["0.5.4"],"ghsa_id":"GHSA-3wgq-wrwc-vqmv","id":"tcs_01M5KES52TP0TSPPX7XEG6FPNW","modified_at":"2025-11-18T16:40:30Z","published_at":"2025-09-23T17:45:07Z","references":["https://osv.dev/vulnerability/GHSA-3wgq-wrwc-vqmv","https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3wgq-wrwc-vqmv","https://github.com/google/security-research/security/advisories/GHSA-9p78-p5g6-gcj8","https://github.com/astral-sh/uv/issues/12163","https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92dc9e02e9cef90684e75","https://github.com/astral-sh/tokio-tar"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-3wgq-wrwc-vqmv","url":"https://osv.dev/vulnerability/GHSA-3wgq-wrwc-vqmv"}],"summary":"astral-tokio-tar has a path traversal in tar extraction"}