zip (crates.io)
Advisories
10
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 9.0.5 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p zip --precise 9.0.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-hjqx-j4rw-g7xv zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. |
High EPSS 0.43% |
>= 7.2.0, < 9.0.0 | 9.0.0 |
| GHSA-q7v9-x93c-xqv3 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction |
High EPSS 0.46% |
>= 1.3.0, < 9.0.0 | 9.0.0 |
| GHSA-m665-v7pm-7grj zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |
Critical EPSS 0.32% |
< 9.0.5 | 9.0.5 |
| GHSA-9hj8-73fh-9963 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size |
High EPSS 0.35% |
>= 5.1.0, < 9.0.0 | 9.0.0 |
| GHSA-8hxf-qr8p-62x4 zip: AES Entry HMAC Authentication Bypass on Premature EOF |
Medium EPSS 0.15% |
>= 0.6.0, < 9.0.0 | 9.0.0 |
| RUSTSEC-2026-0369 ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target |
Critical | >= 0.0.0-0, < 9.0.0 | 9.0.0 |
| RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation |
High | >= 0.0.0-0, < 9.0.0 | 9.0.0 |
| RUSTSEC-2026-0368 zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory |
Not rated yet | >= 0.0.0-0, < 9.0.0 | 9.0.0 |
| GHSA-94vh-gphv-8pm8 zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write |
High EPSS 0.58% |
>= 1.3.0, < 2.3.0 | 2.3.0 |
| GHSA-94vh-gphv-8pm8 zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write |
High EPSS 0.58% |
>= 1.3.0, < 2.3.0 | 2.3.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor