TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution
Researchers studying cybersecurity have revealed a high-severity vulnerability that affects the well-known async-tar Rust library and its forks, such as tokio-tar, and that, under some circumstances, might lead to remote code execution.
Edera identified the vulnerability in late August 2025 and has dubbed it TARmageddon. It is tracked as CVE-2025-62518 (CVSS score: 8.1). It affects a number of popular projects, including wasmCloud and testcontainers.
According to the Seattle-based security firm, this vulnerability has a severity of 8.1 (High) in the worst-case scenario and can result in Remote Code Execution (RCE) through file overwriting attacks, like swapping over configuration files or taking control of build backends.
Despite receiving thousands of downloads through crates.io...