RUSTSEC-2026-0425

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR
archive can create files outside the destination directory — a path traversal
(CWE-22).

In src/dec.rs (Decoder::unpack):

• A symlink entry's target is written without checking where it points
  (src/dec.rs:153), so the archive can create a symlink that escapes the
  destination directory.
• The out-of-destination containment check compares path strings only and does
  not account for symlinks created earlier in the same unpack
  (src/dec.rs:176-181), before reaching the write sinks
  (std::fs::create_dir at src/dec.rs:201 and OpenOptions::open at
  src/dec.rs:218).
• The parser also accepts entry names containing / (src/parser.rs:138-147).

Combined, a malicious archive can include a symlink a pointing at an external
directory and then an entry named a/b, causing b to be written to
<external>/b, outside the destination. This can create new files anywhere the
process can write (it cannot overwrite existing files), which is escalatable to code
execution by planting files in attacker-chosen locations.