Rust advisories / crate
Security history · zip · data from Oct 24, 2026
Is zip safe to use? Its security history
VerdictNo open advisories. 4 past vulnerabilities were fixed; use 9.0.0 or newer to be clear of all of them.
4advisories on record
4vulnerabilities
0unmaintained notices
9.0.0newest fixed version
Every advisory, newest first
- Vulnerability CriticalRUSTSEC-2026-0369 · 2026-10-10ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
- Vulnerability HighRUSTSEC-2026-0367 · 2026-10-09 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
- VulnerabilityRUSTSEC-2026-0368 · 2026-10-09zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
- VulnerabilityRUSTSEC-2025-0168 · 2025-03-16Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Check your version
Run cargo tree -i zip to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.
Download trends, dependents and alternatives: zip crate data.
RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.
Up next
Before you depend on itzip crate dataReal downloads, dependents and alternatives.Read it next →Did this answer your question?