Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

nix-nar

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioPublished

    nix-nar: Decoder::unpack writes archive entries outside the destination directory (path traversal)

    Affected
    • crates.io nix-nar >= 0.0.0-0, < 0.6.0
    Fixed in
    0.6.0· Vendor fix available
    Issue
    `Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal (CWE-22). In `src/dec.rs` (`Decoder::unpack`): - A symlink entry's target is written without checking where it points (`src/dec.rs:153`), so the archive can create a symlink that escapes the destination directory. - The out-of-destination containment check compares path strings only and does not account for symlinks created earlier in the same unpack (`src/dec.rs:176-181`), before reaching the write sinks (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at `src/dec.rs:218`). - The parser also accepts entry names containing `/` (`src/parser.rs:138-147`). Combined, a malicious archive can include a symlink `a` pointing at an external directory and then an entry named `a/b`, causing `b` to be written to ` /b`, outside the destination. This can create new files anywhere the process can write (it cannot…

    Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →