RUSTSEC-2026-0296
`unzip` is unmaintained
The unzip crate has only ever released a single
version, 0.1.0 (published 2017-12-23), and has seen no further activity. It
appears to be unmaintained, and its known path-traversal ("zip-slip")
vulnerability will not be fixed.
Consider migrating to an actively maintained alternative such as zip.
What each source reports
OSV No score
`unzip` is unmaintained
The unzip crate has only ever released a single
version, 0.1.0 (published 2017-12-23), and has seen no further activity. It
appears to be unmaintained, and its known path-traversal ("zip-slip")
vulnerability will not be fixed.
Consider migrating to an actively maintained alternative such as zip.
- Record
RUSTSEC-2026-0296- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unzipcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0296 is a vulnerability with no CVSS score yet in unzip, published September 21, 2026. No source lists public exploit code. No source names a fixed version.