{"id":7067,"library":"cart","title":"CaRT Neutering Format Library","description":"Compressed and RC4 Transport (CaRT) is a file format and an associated Python library used to 'neuter' files for secure distribution, particularly in the malware analysis community. It encrypts and compresses files, optionally embedding metadata, to prevent execution and detection by antivirus software. The library provides functionalities for packing and unpacking CaRT files and currently supports format version 1. It is actively maintained by Cybercentre Canada, with the latest stable release being 1.2.3.","status":"active","version":"1.2.3","language":"en","source_language":"en","source_url":"https://github.com/CybercentreCanada/cart","tags":["security","file-format","malware","encryption","compression","cybersecurity"],"install":[{"cmd":"pip install cart","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"note":"Functions for packing files are nested under the 'pack' submodule.","wrong":"import cart.pack_file","symbol":"pack_file","correct":"from cart.pack import pack_file"},{"note":"Functions for unpacking files are nested under the 'unpack' submodule.","wrong":"import cart.unpack_file","symbol":"unpack_file","correct":"from cart.unpack import unpack_file"},{"note":"Asynchronous packing functionality was introduced in v1.2.3.","symbol":"async_pack_file","correct":"from cart.pack import async_pack_file"}],"quickstart":{"code":"import os\nfrom cart.pack import pack_file\nfrom cart.unpack import unpack_file\n\n# Create a dummy file to pack\noriginal_file = 'test_original.txt'\nwith open(original_file, 'w') as f:\n    f.write('This is a test file for CaRT neutering.')\n\n# Pack the file\ncart_file = 'test_original.cart'\npack_file(original_file, cart_file)\nprint(f\"File packed: {original_file} -> {cart_file}\")\n\n# Unpack the file\nunpacked_file = 'test_unpacked.txt'\nunpack_file(cart_file, unpacked_file)\nprint(f\"File unpacked: {cart_file} -> {unpacked_file}\")\n\n# Verify content (optional)\nwith open(unpacked_file, 'r') as f:\n    content = f.read()\n    print(f\"Unpacked content: {content}\")\n\n# Clean up\nos.remove(original_file)\nos.remove(cart_file)\nos.remove(unpacked_file)\n","lang":"python","description":"This example demonstrates how to pack a simple text file into the CaRT format and then unpack it using the synchronous API. The library handles compression and default ARC4 encryption."},"warnings":[{"fix":"Ensure your project runs on Python 3.6 or newer. Upgrade your Python environment if necessary.","message":"Python 2 support has been entirely removed starting from versions 1.2.0 and 1.2.1. Attempting to use `cart` with Python 2 will result in `ImportError` or `SyntaxError`.","severity":"breaking","affected_versions":">=1.2.0"},{"fix":"When unpacking a CaRT file created with a private key, pass the identical key to the `key` argument of `unpack_file` or `unpack_stream` functions. For example: `unpack_file(cart_path, output_path, key=b'your_private_key')`.","message":"The CaRT format uses ARC4 encryption, with a default key (the first 8 digits of Pi, twice) unless explicitly overridden. If a private key is used during packing, the same private key MUST be provided for unpacking, otherwise decryption will fail.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Upgrade to `cart` version 1.2.3 or higher to benefit from the fix that prevents root path possibilities from metadata filenames.","message":"A vulnerability related to path traversal by crafting metadata filenames was addressed in v1.2.3. Older versions might be susceptible if processing untrusted `.cartmeta` files.","severity":"gotcha","affected_versions":"<1.2.3"}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Run `pip install cart` to install the package.","cause":"The `cart` package is not installed in the current Python environment.","error":"ImportError: No module named 'cart'"},{"fix":"Verify that the path to the input file (e.g., `original_file` or `cart_file`) is correct and the file exists. Use absolute paths for clarity.","cause":"The input file specified for packing or unpacking does not exist at the given path.","error":"FileNotFoundError: [Errno 2] No such file or directory: 'non_existent_file.txt'"},{"fix":"Ensure the correct private key (as `bytes`) is passed to the `key` parameter of the `unpack_file` or `unpack_stream` function. If no key was used, ensure the default key behavior is assumed by not passing a `key` argument, or explicitly passing `None` if that's supported.","cause":"Attempted to unpack a CaRT file that was created with a private key, but no key or an incorrect key was provided during the unpack operation.","error":"cart.exceptions.CaRTException: ARC4 key mismatch. Unpack aborted."}]}