Researchers studying cybersecurity have revealed a high-severity vulnerability that affects the well-known async-tar Rust library and its forks, such as tokio-tar, and that, under some circumstances, might lead to remote code execution.
Edera identified the vulnerability in late August 2025 and has dubbed it TARmageddon. It is tracked as CVE-2025-62518 (CVSS score: 8.1). It affects a number of popular projects, including wasmCloud and testcontainers.
According to the Seattle-based security firm, this vulnerability has a severity of 8.1 (High) in the worst-case scenario and can result in Remote Code Execution (RCE) through file overwriting attacks, like swapping over configuration files or taking control of build backends.
Despite receiving thousands of downloads through crates.io, tokio-tar is basically abandonware, which exacerbates the issue. Built on top of the Tokio runtime for the programming language, Tokio-tar is a Rust library for reading and writing TAR archives asynchronously read more about TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.