On 16 October 2026, the crates.io API listed 136 published versions of the Rust zip crate and marked 127 yanked. Nine were not: 9.0.4, 9.0.3, 8.6.0, 7.4.0, 6.0.0, 5.1.1, 4.6.1, 3.0.0, and 2.6.1. That is the /api/v1/crates/zip response at 17:50 UTC. The crate record shows 302,851,851 all-time downloads. It names 9.0.4 as newest and default, created at 09:09:57 UTC that day, with 5,282 downloads.
The version audit log attributes the yanks to crates.io user Pr0methean (Chris Hennick). 9.0.0, 9.0.1, and 9.0.2 were yanked between 03:33 and 03:43 UTC and were still yanked at the check. 8.6.0, 6.0.0, 5.1.1, 4.6.1, and 3.0.0 were yanked early on 16 October and unyanked between 16:47 and 16:48 UTC. 7.4.0’s yank entry is 15 February 2026, with an unyank at 16:47 UTC on 16 October. 2.6.1 was yanked on 15 May 2025 and unyanked at 17:47 UTC on 16 October. The API has no yank message, and nothing opened here says why those seven were restored.
Three high advisories
The zip2 advisories page lists three high-severity reports from 9 and 10 October, plus an older 2025 issue. Each October page says “No known CVE.” The repository advisory API returns severity high and a null CVE id for each. None of the three says the bug is being exploited in the wild.
GHSA-4v9h-p7m9-rh26 (9 October 2026, API time 04:52 UTC, CWE-22) says that in zip 9.0.0-pre2, ZipArchive::extract creates a symbolic link after checking only the output path, then passes the target bytes to the platform symlink call, so a link inside the destination can point outside it. The page says this was verified on macOS and Linux, and that a later read or write through the link can reach an outside file, within the process’s permissions. Range <= 9.0.0-pre3, patched version listed 9.0.0.
GHSA-vv5m-jxxh-4627 (9 October 2026, API time 04:51 UTC) is CWE-732. Extraction keeps SUID, SGID, and the sticky bit from the archive instead of masking them. If a privileged process extracts an attacker-controlled archive with ZipArchive::extract or the stream API, the page says files can be created setuid or setgid, which can lead to local privilege escalation depending on the environment. Same range, <= 9.0.0-pre3, patched in 9.0.0.
GHSA-4684-h2q9-2vcp (10 October 2026, API time 06:14 UTC, CWE-61) says ZipStreamReader::extract applies Unix permissions through an extracted symlink without keeping the target inside the destination. The title also names ZipArchive::extract. It says this was confirmed by source review on shipped v8.6.0, with no runtime execution in that report. The reporter says the draft used AI assistance and was checked by hand. Range <= 9.0.0, patched version listed 9.0.1.
9.0.0, 9.0.1, and 9.0.2 are yanked. The changelog says 9.0.1 fixed set_permissions still following symlinks outside the streaming path, and 9.0.2 added further symlink-extraction fixes. The 9.0.4 note, dated 16 October, says enclosed_name rejects a separator inside one verbatim path component.
What a resolver can still select
8.6.0 is unyanked, and GHSA-4684 names it. Its download count in this response is 27,296,908, so a requirement of zip = "8" can still resolve to it. The other unyanked older versions, including 2.6.1, also sit inside the ranges on the October pages. 2.6.1 is at or after 2.3.0, the patched line named on the older RustSec advisory below.
Cargo’s yank page says Cargo will not use a yanked version for a new project or a checkout with no lockfile, and will error if nothing compatible remains. A lockfile that already pins a yanked version can still build. cargo tree -i zip lists which packages in the tree depend on zip.
RustSec lists RUSTSEC-2025-0168 for an older zip path bug, aliases GHSA-94vh-gphv-8pm8 and CVE-2025-29787, affected from 1.3.0 before 2.3.0 and patched in 2.3.0 and later. The index page opened on 16 October did not contain the three October GHSA ids. cargo audit reports that database, so an audit against it would not show these three ids.
The reverse-dependency list totaled 3,984 direct registry dependents, which is not a count of applications.
On the 9.0 line, 9.0.4 is the newest unyanked release. A refresh will not select 9.0.0, 9.0.1, or 9.0.2 while they stay yanked, and it can still select 8.6.0. What a lockfile freezes is the subject of Cargo.lock, SemVer and the update that broke your build.
The Campfire
No commentsNobody has pulled up a log by this one yet. Be the first to say what you make of it.
Held for the desk. It appears after a look.