AIKIDO-2026-10359

TL;DR

Affected versions extract corpus tar and zip archives using tarfile.extractall() and zipfile.extractall() without validating member paths or symlink targets. A malicious or tampered archive (e.g. from a compromised or MITM corpus source) can contain members with path traversal sequences (e.g. ..) or symlinks pointing outside the extraction directory, leading to files being written or overwritten outside the intended data directory. The patch adds _is_within_directory(), _safe_extract_tar(), and _safe_extract_zip() to validate all member paths and symlink targets before extraction and uses them in the corpus download flow.