{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.0.0-0"}],"component":"decompress","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":[],"id":"tcs_01M5KFCD43ZT59S49G4DV85FKB","modified_at":"2026-10-03T07:30:03.083352599Z","published_at":"2026-09-19T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0328","https://crates.io/crates/decompress","https://rustsec.org/advisories/RUSTSEC-2026-0328.html","https://github.com/rusty-ferris-club/decompress/issues/21"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0328","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0328"}],"summary":"`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)"}