CVE-2026-23949 Details

A Zip Slip path traversal vulnerability has been identified in the jaraco.context package, specifically in the tarball() function. This vulnerability affects versions 5.2.0 prior to 6.1.0. When malicious tar archives are processed, the vulnerability may allow attackers to extract files outside the intended extraction directory. The issue arises from the strip_first_component filter, which improperly handles path components and allows traversal sequences, leading to extraction of files from sensitive locations such as the root or home directories. Additionally, this vulnerability is present in nested tarball scenarios, where inner tar files can exploit the same traversal issues. The vulnerable behavior can be observed in the context of the Python packaging tool setuptools, which vendors the jaraco.context package and may inadvertently introduce this vulnerability when handling tarball extractions.

Users can update to jaraco.context version 6.1.0, which addresses the vulnerability by implementing proper extraction safety. For those using setuptools, be aware that this version is also available through the Python Package Index (PyPI).