Package vulnerability, severity high

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Published October 30, 2026, updated October 31, 2026

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal). Source: RUSTSEC-2026-0425.

What's affected

• nix-nar (cargo)>=0.0.0-0 <0.6.0

What to do

1. Upgrade nix-nar to 0.6.0 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident rustsec-2026-0425

References

• https://osv.dev/vulnerability/RUSTSEC-2026-0425
• https://crates.io/crates/nix-nar
• https://rustsec.org/advisories/RUSTSEC-2026-0425.html
• https://codeberg.org/scvalex/nix-nar-rs/issues/3

Notice rustsec-2026-0425, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.