crates.io/zip: critical 9.1

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Action: Upgrade zip to 9.0.0 or later.

cargo update -p zip --precise 9.0.0

Affected

Fixed versions

Sources

• osv: RUSTSEC-2026-0369
• https://crates.io/crates/zip
• https://rustsec.org/advisories/RUSTSEC-2026-0369.html

published 2026-10-10T12:00:00Z · modified 2026-10-16T23:30:02.387698467Z · JSON