RESEARCHERS UNCOVER REMOTE CODE EXECUTION FLAW IN ABANDONED RUST CODE LIBRARY

Summary from the TLDR InfoSec newsletter

CVE-2025-62518 is a high-severity boundary-parsing vulnerability (CVSS 8.1) in the abandoned async-tar Rust library that allows remote code execution through file overwriting. The flaw affects critical tools, including the uv package manager, tokio-tar (5+ million downloads), and multiple widely-used forks. The issue highlights the open-source abandonware crisis, where unmaintained code is repeatedly forked, spreading bugs across ecosystems with limited visibility and patchability. Security teams should audit dependencies for async-tar and related forks (tokio-tar, testcontainers, wasmCloud), apply available patches, and establish processes to track abandoned dependencies.