Skip to content
OpenAdvisories

Package · Wolfi

pixi-compat

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2025-62518 Public exploit

    astral-tokio-tar Vulnerable to PAX Header Desynchronization

    astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar hea…

    astral-sh tokio-tar wash pixi Debian Ubuntu Wolfi crates.io
  • High 7.3
    CVE-2025-29787

    zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write

    `zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are…

    zip-rs zip2 deno pixi Ubuntu Wolfi crates.io
  • High 7.5
    CVE-2024-45311

    Denial of service in quinn-proto when using `Endpoint::retry()`

    Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unval…

    quinn-rs quinn wasmcloud wash Wolfi crates.io