Loading story…
A high-severity vulnerability, tracked as CVE-2025-62518 and codenamed TARmageddon, was discovered in the async-tar Rust library and its numerous forks, including tokio-tar, astral-tokio-tar, krata-tokio-tar, and others. The flaw, which carries a CVSS score of 8.1, allows for remote code execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends. The vulnerability stems from inconsistent handling of PAX extended headers and ustar headers when determining file data boundaries, specifically when processing archives with PAX-extended headers containing size overrides. This parsing error enables attackers to smuggle additional archive entries by exploiting the mismatch, causing the parser to interpret file content as legitimate TAR headers. The async-tar library and its forks are widely used in critical tools and environments, including the uv Python package manager, testcontainers, and wasmCloud, amplifying the potential impact of the flaw. The most popular fork, tokio-tar, has over 5 million downloads on crates.io but is no longer maintained, increasing the risk as users may not receive timely patches. Edera, the security company that discovered the vulnerability in August 2025, highlighted the systemic risk posed by the open-source abandonware crisis, as the bug was inherited by a deep lineage of forks after the original project became unmaintained. Edera created and distributed patches for active forks, with astral-tokio-tar releasing version 0.5.6 to remediate the issue. However, users of unmaintained forks like tokio-tar are advised to migrate to patched alternatives such as astral-tokio-tar. The vulnerability's discovery underscores the challenges in tracking and patching security flaws in widely forked and abandoned open-source projects. The flaw's presence in foundational libraries for async archive processing in the Rust ecosystem means that build systems and production environments across many organizations could be at risk. Security experts warn that the lack of visibility into the use of these libraries further complicates mitigation efforts. The incident has reignited discussions about the need for better maintenance and oversight of critical open-source infrastructure. Organizations relying on affected libraries are urged to assess their exposure and implement available patches or migrate to maintained alternatives immediately. The coordinated disclosure and patching efforts by Edera aimed to minimize the window of exploitation before public announcement. This event highlights the importance of proactive vulnerability management and the risks associated with relying on unmaintained open-source components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-10-21, Edera publicly disclosed CVE-2025-62518, assigning it a CVSS score of 8.1 and warning that widespread forking and poor dependency visibility could amplify impact. Public reporting highlighted the risk to build systems and production environments from inherited vulnerabilities in abandoned open-source code.
On 2025-08-22, Edera produced patches and began a decentralized remediation effort to get fixes into active forks and downstream projects before public disclosure. The issue was reported as affecting projects including tokio-tar and the uv package manager.
On 2025-08-21, Edera identified a high-severity boundary-parsing logic flaw in the abandoned Rust async-tar codebase. The vulnerability, later dubbed TARmageddon, could enable file overwrites leading to remote code execution and was found to affect forks and downstream consumers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcecsoonline.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Rust Security Response Team disclosed **Cargo** vulnerabilities tracked as `CVE-2026-5222` and `CVE-2026-5223`, highlighting risks in how Rust tooling processes package archives from **third-party registries**. In the published details for `CVE-2026-5223`, Cargo was found to mishandle symlinks inside crate tarballs, allowing a malicious crate to overwrite the cached source of another crate from the same registry by extracting files outside its intended cache path. The issue does **not** affect `crates.io`, which already blocks crates containing symlinks, but it affects Cargo versions shipped before **Rust 1.96.0**; the fix rejects extraction of any symlink found in crate tarballs. The disclosures align with a separate advisory affecting the Rust package **astral-tokio-tar**, where a **PAX header desynchronization** bug in versions before `0.6.2` can cause tar archives to be interpreted differently from other implementations. That flaw can let attackers hide or reveal archive members unexpectedly and potentially smuggle files onto a victim filesystem during extraction. Together, the advisories underscore a broader supply-chain risk in Rust archive handling: malformed tar metadata and symlink processing can let malicious packages alter extracted contents in ways developers and automated tooling may not expect. Users are advised to upgrade to fixed releases and, where upgrades are not yet possible, audit registry content and block symlinks in published crates.
Jun 29, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026
A critical security vulnerability, tracked as CVE-2025-61927, has been discovered in the Happy DOM JavaScript library, which is widely used for server-side rendering and testing frameworks. The flaw allows attackers to escape the virtual machine (VM) context, potentially leading to remote code execution on affected systems. Happy DOM, with over 2.7 million weekly downloads, is integrated into numerous applications, amplifying the potential impact of this vulnerability. The root cause of the issue lies in improper isolation of the Node.js VM context in Happy DOM versions 19 and earlier, which fails to adequately sandbox untrusted code. Security researcher Mas0nShi identified that attackers can exploit the JavaScript constructor inheritance chain to access the global Function constructor, enabling arbitrary code execution. In environments using the CommonJS module system, attackers can further leverage the require() function to import and execute additional modules, broadening the attack surface. While ECMAScript module (ESM) environments restrict some capabilities, they are still affected by the core VM context escape. The vulnerability has been assigned a CVSS score of 9.4, underscoring its severity and the urgency for remediation. Millions of applications that rely on Happy DOM for testing or server-side rendering are at risk if they have not updated to a patched version. The flaw enables attackers to bypass intended security boundaries, potentially compromising the host system and any sensitive data processed within the affected environment. Security advisories recommend immediate updates to the latest version of Happy DOM to mitigate the risk. Organizations are urged to review their software supply chain for dependencies on Happy DOM and to apply patches as soon as possible. The vulnerability highlights the risks associated with improper sandboxing in JavaScript environments, especially in widely adopted open-source libraries. No reports of active exploitation have been confirmed at this time, but the public disclosure and technical details increase the likelihood of exploitation attempts. Security teams should monitor for suspicious activity related to Node.js processes and review application logs for signs of compromise. The incident serves as a reminder of the importance of rigorous security testing and isolation in libraries that execute untrusted code. Developers and DevOps teams should prioritize dependency management and vulnerability scanning to reduce exposure to similar flaws in the future.
Jun 29, 2026