RUSTSEC-2025-0172None▾ Sunlit`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
The zip-extract crate has been
explicitly deprecated by its author on Jul 16, 2025, and the repository
was archived on Sep 8, 2025.
The author added deprecation notices README
stating that the functionality is now available directly in the zip crate
via ZipArchive::extract
(available since zip 0.6.0) and
ZipArchive::extract_unwrapped_root_dir
(available since zip 2.4.0).
If you are using zip-extract, switch to the
zip >= 2.4.0 crate and use the methods above instead.
zip-extract >= 0.0.0-0Refer to the advisory for the patched release.