AIKIDO-2026-95493

TL;DR

The library assembles unrar subprocess command lines and parses RAR5 metadata while trusting several archive-controlled fields. Member names beginning with a dash are appended to the unrar argument list without a separator, so crafted filenames inject extraction flags, and NUL bytes, oversized password key-derivation counts, unbounded declared file sizes, and unsafe symlink targets are validated inconsistently. Processing a malicious archive can redirect or escape extraction, overwrite sibling files, exhaust CPU or memory, or crash the parser. The fix adds argument delimiters and path prefixes, caps sizes and iteration counts, contains symlink targets, and tightens header validation.