RUSTSEC-2026-0425

Dashboard / Vulnerabilities / RUSTSEC-2026-0425

RUSTSEC-2026-0425

Summary: `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Details: `Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR archive can create files **outside** the destination directory — a path traversal (CWE-22). In `src/dec.rs` (`Decoder::unpack`): - A symlink entry's target is written without checking where it points (`src/dec.rs:153`), so the archive can create a symlink that escapes the destination directory. - The out-of-destination containment check compares path **strings** only and does not account for symlinks created earlier in the same unpack (`src/dec.rs:176-181`), before reaching the write sinks (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at `src/dec.rs:218`). - The parser also accepts entry names containing `/` (`src/parser.rs:138-147`). Combined, a malicious archive can include a symlink `a` pointing at an external directory and then an entry named `a/b`, causing `b` to be written to `<external>/b`, outside the destination. This can create new files anywhere the process can write (it cannot overwrite existing files), which is escalatable to code execution by planting files in attacker-chosen locations.

References: https://crates.io/crates/nix-nar, https://rustsec.org/advisories/RUSTSEC-2026-0425.html, https://codeberg.org/scvalex/nix-nar-rs/issues/3