https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 17:08:45 +0000 https://db.gcve.eu/vuln/rustsec-2026-0367 <p><strong>Affected:</strong> crates.io: zip</p> <p>The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.</p> <p>For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627</p> <p><strong>Affected:</strong> crates.io: zip</p> <p>The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.</p> <p>For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627</p> https://db.gcve.eu/vuln/rustsec-2026-0367