A vulnerability (CVE-2026-115905) has been discovered in the zip-rs library, which is written in Rust and has around 10 million downloads per week. This vulnerability allows the creation of archives that appear harmless, but when extracted, they reveal other files that were not originally displayed in the list. Files can be placed in the archive outside of the "Central Directory" structure, causing one set of content to be displayed in the file list, while different files are extracted via the ZipStreamReader API. The issue has been assigned a severity level of 10 out of 10. The vulnerability has been fixed in zip-rs version 9.0.5.
The vulnerability arises from using different headers for random access to the archive through the ZipArchive API and for extracting data in streaming mode using the ZipStreamReader API. The ZipArchive handler relies on the CDFH (Central Directory File Header), while the ZipStreamReader prioritizes the LFH (Local File Header) during file extraction without synchronizing overlapping metadata.
This vulnerability can be exploited to bypass mail filters, antivirus scanners, and other security verification systems. An attacker can place a document or image in the visible part of an archive, while hiding a malicious executable file in the hidden section that will go unnoticed by antivirus software but will be saved to disk when extracted by the user. Examples include attacks on microservices, SaaS platforms, and container isolation systems, where harmless-looking archives containing style sheets, text files, or images could overwrite scripts and executables in directories with active projects.
Additionally, a vulnerability (CVE-2026-96889) has been noted in the librsvg library, developed by the GNOME project in Rust. This library is used in GTK and GNOME applications for rendering SVG, and is also utilized in the popular NPM package sharp, which has 80 million downloads per week and is a dependency for nearly 11,000 projects. The vulnerability allows for the execution of arbitrary code when processing specially crafted SVG images. The issue has been fixed in librsvg versions 2.56.6, 2.60.3, 2.62.4, and 2.63.1, as well as in NPM package sharp 0.35.5. Among the affected projects is the PeerTube platform (the dependency has been updated in today's release of PeerTube 8.3.2).
To parse the XML markup used in SVG files, librsvg uses functions from the C library libxml2. The vulnerability is caused by the presence of nested XML constructs Xincludes in the SVG, which include duplicate elements with repeating names, leading to access to memory after it has been freed. The crash occurs because the librsvg library frees the memory allocated for XML elements that are still being used in the libxml2 parser.
Source: opennet.ru
