AIKIDO-2026-10281

TL;DR

Affected versions of this package are vulnerable to a path traversal in the archive extraction functionality. Specifically, archive entries containing crafted file paths (such as paths resolving outside the intended directory) could be extracted in a way that escapes the target directory, potentially overwriting or creating files in arbitrary locations. This behavior can be exploited by an attacker supplying a malicious archive to write or overwrite sensitive files on the host filesystem.