mirror of
https://github.com/oven-sh/bun
synced 2026-02-17 14:22:01 +00:00
The POSIX mkdiratZ calls for directory entries were using the unnormalized `pathname` variable instead of the normalized `path` variable. This allowed malicious tarballs with `../` in directory entry names to create directories outside the extraction root. The Windows codepath already correctly used the normalized `path`. Co-Authored-By: Claude <noreply@anthropic.com>