Researchers uncover remote code execution flaw in abandoned Rust code library

The high-severity defect affects a widely used — but largely hidden — archive tool that spans many forks.

Security specialists at Edera discovered and disclosed a high-severity vulnerability in an early and since-abandoned code for an open-source async tar archive library for the Rust programming language. 

Researchers warned that potential exploitation, which allows for remote code execution, could bear major impacts due to widespread forking and a lack of visibility into the code’s use. 

“Given its presence in critical, widely-deployed tools like the uv package manager, the potential impact on build systems and production environments across many companies is substantial,” Alex Zenla, chief technology officer and co-founder at Edera, told CyberScoop in an email.

The boundary-parsing vulnerability — CVE-2025-62518, which has a CVSS rating of 8.1 — affects the async-tar Rust library and many forks, including tokio-tar, the Python package manager uv, testcontainers, wasmCloud, astral-tokio-tar and krata-tokio-tar. The most-popular fork — tokio-tar — has more than 5 million downloads on crates.io and is no longer maintained, according to Edera.

“This vulnerability is a textbook case of the open-source abandonware crisis. The original bug was introduced in an early version of the code that was then repeatedly forked as the original project became unmaintained,” Zenla said.  

“The bug was replicated across a deep lineage of these forks,” she added. “When one project stops maintaining code, the bug gets inherited by the entire downstream family, creating a systemic risk that’s incredibly difficult to track and patch efficiently.”

Edera discovered the vulnerability during a development push on its internal platforms Aug. 21. The cybersecurity company created patches the next day and worked to get the fixes into as many active forks and open-source projects as possible before it publicly disclosed the defect Tuesday.

Zenla said tokio-tar and its forks are the foundation for async archive processing across the Rust ecosystem. These tar archives are fundamental for distribution, presenting a vast scope of potential impact, she added. 

“The most concerning part is the unawareness,” Zenla said. “This vulnerable code is often an indirect dependency, buried deep in a build tool or container pipeline. Most end-users or businesses don’t even know they are running it, which is why public disclosure is a critical remediation step.”

Attackers can exploit the vulnerability and achieve remote code execution through file overwriting, according to Edera. The defect is not a complex memory corruption issue, but rather a logic flaw and considered easy to exploit, Zenla said. 

Rust is widely acknowledged as a more secure programming language because it eliminates memory safety vulnerabilities that are common in C and C++. Yet, CVE-2025-62518, which Edera dubbed “TARmageddon,” proves that no language is completely secure and safer languages are still susceptible to human errors, Zenla said. 

The defect also serves as another reminder of the risks lurking in open-source code, particularly when the chain of responsibility breaks as original versions are abandoned or no longer maintained. 

“This meant we couldn’t just submit one patch upstream. We had to engage in a difficult, decentralized disclosure — tracking down and coordinating with multiple active forks and downstream consumers to ensure the patch was applied everywhere,” Zenla said. 

“When a project is truly abandoned, responsibility becomes a messy, manual, and highly inefficient process for the ecosystem to resolve.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure