AIKIDO-2025-10457

TL;DR

Affected versions of this package are vulnerable to path traversal when extracting tar archives containing malicious symlinks, as the safe_extract function checks directory traversal for regular files but does not properly validate symbolic links, allowing an attacker to write arbitrary files outside the target directory by including specially crafted symlinks in the archive.