CVE-2026-79655: Python Tarfile Fully Trusted Extraction Filtercve-2026-79655-python-tarfile-fully-trusted-extraction-filter
Tar members are extracted with every tarfile protection disabled: extraction_filter is set to tarfile.fully_trusted_filter (or to a pass-through lambda, the fallback used on Pythons that ignore the attribute). tarfile will then faithfully create symlink/hardlink members whose targets are absolute or escape the destination ('../'), and later regular-file memb
