AIKIDO-2026-95493
rarfile is vulnerable to Argument Injection
70
High Risk
This Affects:
rarfileTL;DR
The library assembles unrar subprocess command lines and parses RAR5 metadata while trusting several archive-controlled fields. Member names beginning with a dash are appended to the unrar argument list without a separator, so crafted filenames inject extraction flags, and NUL bytes, oversized password key-derivation counts, unbounded declared file sizes, and unsafe symlink targets are validated inconsistently. Processing a malicious archive can redirect or escape extraction, overwrite sibling files, exhaust CPU or memory, or crash the parser. The fix adds argument delimiters and path prefixes, caps sizes and iteration counts, contains symlink targets, and tightens header validation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application opens or extracts RAR archives from untrusted or externally supplied sources.
Background info
rarfile is vulnerable to Argument Injection in versions 0.0.1 - 4.4.0.
How to fix this
Upgrade the rarfile library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant