{"action":"Upgrade zip to 9.0.0 or later.","affected":[{"fixed":"9.0.0","introduced":"0.0.0-0"}],"component":"zip","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["9.0.0"],"ghsa_id":"GHSA-4684-h2q9-2vcp","id":"tcs_01M5JHHZE8HBJDKTJ5X8YNKBMK","modified_at":"2026-10-16T23:30:02.387698467Z","published_at":"2026-10-10T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0369","https://crates.io/crates/zip","https://rustsec.org/advisories/RUSTSEC-2026-0369.html"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0369","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0369"}],"summary":"ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target"}