RUSTSEC-2026-0434 `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

ant-releases downloads and unpacks release archives from the safenetwork / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check for .. or absolute components — a classic "zip-slip" path...

CVE-2026-97365

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly...

PT-2026-98293

Name of the Vulnerable Software and Affected Versions chonkie-inc littrs versions 0.6.1 through 0.6.2 Description A remote path traversal issue exists in the Sandbox::mount function within the crates/littrs/src/lib.rs file. This occurs when the relative argument is manipulated, allowing an attack...

CVE-2025-59053

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the "packages/stage-ui/src/components/MarkdownRenderer.vue" path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...