{"id":"RUSTSEC-2026-0296","aliases":[],"status":"published","title":"`unzip` is unmaintained","description":"The [unzip](https://crates.io/crates/unzip) crate has only ever released a single\nversion, `0.1.0` (published 2017-12-23), and has seen no further activity. It\nappears to be unmaintained, and its known path-traversal (\"zip-slip\")\nvulnerability will not be fixed.\n\nConsider migrating to an actively maintained alternative such as\n[zip](https://crates.io/crates/zip).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-09-21T12:00:00Z","modified":"2026-09-21T15:30:02Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"unzip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/unzip","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0296.html","tags":["advisory"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0296","title":"`unzip` is unmaintained","description":"The [unzip](https://crates.io/crates/unzip) crate has only ever released a single\nversion, `0.1.0` (published 2017-12-23), and has seen no further activity. It\nappears to be unmaintained, and its known path-traversal (\"zip-slip\")\nvulnerability will not be fixed.\n\nConsider migrating to an actively maintained alternative such as\n[zip](https://crates.io/crates/zip).","status":"published","published":"2026-09-21T12:00:00Z","modified":"2026-09-21T15:30:02.903397197Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}