crates.io/zip: unknown

zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

Action: Upgrade zip to 9.0.0 or later.

cargo update -p zip --precise 9.0.0

Affected

Fixed versions

Sources

• osv: RUSTSEC-2026-0368
• https://crates.io/crates/zip
• https://rustsec.org/advisories/RUSTSEC-2026-0368.html

published 2026-10-09T12:00:00Z · modified 2026-10-16T23:30:02.383750571Z · JSON