RUSTSEC-2026-0425: `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)
Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal (CWE-22).
In src/dec.rs (Decoder::unpack):
- A symlink entry's target is written without checking where it points (src/dec.rs:153), so the archive can create a symlink that escapes the destination directory. - The out-of-destination containment check compares path strings only and does not account for symlinks created earlier in the same unpack (src/dec.rs:176-181), before reaching the write sinks (std::fs::createdir at src/dec.rs:201 and OpenOptions::open at src/dec.rs:218). - The parser also accepts entry names containing / (src/parser.rs:138-147).
Combined, a malicious archive can include a symlink a pointing at an external directory and then an entry named a/b, causing b to be written to <external>/b, outside the destination. This can create new files anywhere the process can write (it cannot overwrite existing files), which is escalatable to code execution by planting files in attacker-chosen locations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/nix-narto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application that uses Decoder::unpack to extract a malicious or untrusted NAR archive is exposed. The impact is limited by the filesystem locations writable by the process performing the unpack.
What does an attacker need to exploit it?
An attacker needs to supply a crafted NAR archive for extraction. The archive can create a symlink to an external directory and then use a slash-containing entry name such as a/b to write outside the chosen destination.
Can the attacker overwrite existing files?
No. The described behavior can create new files in locations writable by the unpacking process, but it cannot overwrite existing files.
Why can this lead to code execution?
Creating new files in attacker-chosen writable locations may be escalatable to code execution if an attacker can plant a file where it will later be executed or loaded by another process.