RUSTSEC-2026-0425 `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...

gen-polyglot (>=0.1.30, <=0.1.55), nix-nar-cli (>=0.1.0, <=0.3.1) potentially affected by unknown CVE via nix-nar (>=0.1.0, <=0.3.1)

nix-nar CARGO version =0.1.0, =0.1.30, =0.1.0, =0.3.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0425...

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...

nix: coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser

A flaw was found in Nix. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrar...