📦 Go Slug

HashiCorp's go-slug library is vulnerable to a zip-slip attack when extracting tar archives with non-existing user-provided paths. This allows attackers to write arbitrary files outside the intended e...