{"action":"Upgrade zip to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"1.3.0"}],"component":"zip","cve_ids":["CVE-2025-29787"],"ecosystem":"crates.io","epss":0.00585,"exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-94vh-gphv-8pm8","id":"tcs_01M5KFAN9BCQ1WQHGZ4Y14JJTN","modified_at":"2026-10-12T18:00:13.042644063Z","published_at":"2025-03-16T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2025-0168","https://crates.io/crates/zip","https://rustsec.org/advisories/RUSTSEC-2025-0168.html","https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"RUSTSEC-2025-0168","url":"https://osv.dev/vulnerability/RUSTSEC-2025-0168"},{"source":"nvd","source_id":"CVE-2025-29787","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29787"}],"summary":"Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write"}