Arbitrary permission modification via vulnerable `tar` dependency (CVE-2026-33056)

**Vulnerability Cause (Root Cause):**
We are conducting research on the exploitability of dependencies in the Rust ecosystem. We discovered that `dioxus-cli` depends on the `tar` crate version `0.4.44`. Versions of `tar` prior to `0.4.45` are vulnerable to CVE-2026-33056. The library fails to prevent symlink following during extraction, allowing a maliciously crafted tarball to use `chmod` to arbitrarily modify the permissions of directories outside the intended extraction path.

**Trigger Conditions:**
The vulnerability is triggered when `dioxus-cli` downloads and unpacks the prebuilt OpenSSL binaries during the Android build process (specifically in `AndroidTools::unpack_prebuilt_openssl()`).

**Trigger Results (Impact & Evidence):**
If the downloaded archive is intercepted or tampered with (e.g., via MITM or compromised mirror), the malicious archive can escalate the permissions of arbitrary external directories on the host filesystem. In our local validation, extracting a crafted `openssl-1.1.1q-beta-1.tar.gz` successfully changed the permissions of a protected external victim directory from `0700` to `0777`, potentially leading to privilege escalation.

```text
# Execution Logs
victim_dir_before = 700
dx build --platform android
victim_dir_after = 777
```
**Environment:**

- **Dioxus Version:** `0.7.5` (cli and in Cargo.toml)
- **Rust Version:** `rustc 1.94.1 `
- **OS Info:** Ubuntu22.04

**Remediation Suggestion:**
Please bump the `tar` dependency in `Cargo.toml` to `>= 0.4.45` to mitigate this issue.