DemoBook a demo

Vulnerability advisory

RUSTSEC-2026-0369

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Published Updated OSV record ↗

Showing RUSTSEC-2026-0369 for GHSA-4684-h2q9-2vcp.

Also known as GHSA-4684-h2q9-2vcp

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected versions

zip crates.io

All zip advisories →
AffectedFixed in
0.0.0-0 to before 9.0.09.0.0Advisories →

Description

ZipStreamReader::extract() applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.