{"id":59558,"date":"2025-10-22T13:15:06","date_gmt":"2025-10-22T13:15:06","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/forking-confusing-vulnerable-rust-crate-exposes-uv-python-packager\/"},"modified":"2025-10-22T13:15:06","modified_gmt":"2025-10-22T13:15:06","slug":"forking-confusing-vulnerable-rust-crate-exposes-uv-python-packager","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/forking-confusing-vulnerable-rust-crate-exposes-uv-python-packager\/","title":{"rendered":"Forking confusing: Vulnerable Rust crate exposes uv Python packager"},"content":{"rendered":"

A vulnerability in the popular Rust crate async-tar has affected the fast uv Python package manager, which uses a forked version that’s now patched \u2013 but the most widely downloaded version remains unfixed.<\/p>\n

The vulnerability is an error in the header parsing code that allows an attacker to hide additional files in a tar archive, discovered by a team at secure computing company Edera.<\/p>\n

The tar format can support both ustar (Unix Standard TAR) and pax headers, the latter was added as an extension to tar decades ago. When a file entry has both ustar and pax headers, the code advances the stream position based on the ustar size, often zero, rather than the pax size, which should override it. This means it may interpret file content as a tar header, enabling smuggled files. Edera stated<\/a> that this enables file overwriting attacks, supply chain attacks “via build system and package manager exploitation,” and bypass of BOM (bill of materials) security scanning.<\/p>\n