RUSTSEC-2026-0425 `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...