Skip to content
OpenAdvisories

Package · crates.io

decompress

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    RUSTSEC-2026-0328

    `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

    The tar-family extractors in `decompress` (`.tar`, `.tar.gz`, `.tar.xz`, `.tar.bz2`, `.tar.zst`) build each output path from the **raw archive entry path** and write to it with no traversal check, so a malicious archive can write files **outside** the destina…

    decompress crates.io