Vulnerability RUSTSEC-2026-0425

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal (CWE-22).

In src/dec.rs (Decoder::unpack):

• A symlink entry's target is written without checking where it points (src/dec.rs:153), so the archive can create a symlink that escapes the destination directory.
• The out-of-destination containment check compares path strings only and does not account for symlinks created earlier in the same unpack (src/dec.rs:176-181), before reaching the write sinks (std::fs::create_dir at src/dec.rs:201 and OpenOptions::open at src/dec.rs:218).
• The parser also accepts entry names containing / (src/parser.rs:138-147).

Combined, a malicious archive can include a symlink a pointing at an external directory and then an entry named a/b, causing b to be written to <external>/b, outside the destination. This can create new files anywhere the process can write (it cannot overwrite existing files), which is escalatable to code execution by planting files in attacker-chosen locations.