{"action":"Upgrade tar to 0.4.45 or later.","affected":[{"fixed":"0.4.45","introduced":"0.0.0-0"}],"component":"tar","cve_ids":["CVE-2026-33056"],"ecosystem":"crates.io","epss":0.00386,"exploited":false,"fixed_versions":["0.4.45"],"ghsa_id":"GHSA-j4xf-2g29-59ph","id":"tcs_01M5KFB290E6BPQNM2CB5M6WE7","modified_at":"2026-03-23T09:45:06.946281Z","published_at":"2026-03-19T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0067","https://crates.io/crates/tar","https://rustsec.org/advisories/RUSTSEC-2026-0067.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0067","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0067"},{"source":"nvd","source_id":"CVE-2026-33056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056"}],"summary":"`unpack_in` can chmod arbitrary directories by following symlinks"}