RUSTSEC-2026-0425

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0425

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0425.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0425

Published

2026-10-30T12:00:00Z

Modified

2026-10-30T10:45:03Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Details

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal (CWE-22).

In src/dec.rs (Decoder::unpack):

A symlink entry's target is written without checking where it points (src/dec.rs:153), so the archive can create a symlink that escapes the destination directory.
The out-of-destination containment check compares path strings only and does not account for symlinks created earlier in the same unpack (src/dec.rs:176-181), before reaching the write sinks (std::fs::create_dir at src/dec.rs:201 and OpenOptions::open at src/dec.rs:218).
The parser also accepts entry names containing / (src/parser.rs:138-147).

Combined, a malicious archive can include a symlink a pointing at an external directory and then an entry named a/b, causing b to be written to <external>/b, outside the destination. This can create new files anywhere the process can write (it cannot overwrite existing files), which is escalatable to code execution by planting files in attacker-chosen locations.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / nix-nar

Package

Name: nix-nar; View open source insights on deps.dev
Purl: pkg:cargo/nix-nar

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.6.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "nix_nar::Decoder::unpack"
        ],
        "os":  []
    }
}