GHSA-hp8f-xmx4-4qrg

cap-primitives resolves a path inside a sandboxed directory one component at a time and opens the last component with O_NOFOLLOW, so that a symlink there cannot lead out of the directory. When the path ended in /, the resolver added the slash back to the last component before opening it. With a trailing slash the operating system no longer treats that component as the last one, so O_NOFOLLOW does not apply, the symlink is followed, and the resulting file descriptor was returned without further checks.

A symlink inside the sandbox that points outside it, such as escape -> ../outside or a link to /, can therefore be opened as escape/. If the symlink's own target ends in /, the caller's path does not need a trailing slash at all, so removing trailing slashes from untrusted input is not a workaround. The maintainers' advisory reports reads and writes outside the sandbox through open, open_dir, read_dir and canonicalize, and directory creation, removal and renames outside it through create_dir, remove_dir and rename.

This resolver is used on Windows and macOS, on FreeBSD when O_RESOLVE_BENEATH is not available, and on Linux when openat2 is not available (kernels before 5.6, or a seccomp policy that rejects it). cap-std and other crates built on cap-primitives are affected through it. Wasmtime's WASI filesystem support was affected as well; that is covered by RUSTSEC-2026-0269.

The fix stops re-adding the trailing slash and is in 3.4.6 and 4.0.3.