Skip to content
OpenAdvisories

Package · crates.io

nix-nar

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    RUSTSEC-2026-0425

    `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

    `Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR archive can create files **outside** the destination directory — a path traversal (CWE-22). In `src/dec.rs` (`Decoder::unpack`): - A symlink entry's target is written without …

    nix-nar crates.io