Arbitrary file permission modification during extraction via vulnerable `tar` dependency (CVE-2026-33056) <br />

Nobody has claimed this yet.

**Error Description:**
We discovered that `PyOxidizer` relies on an outdated `tar` crate (`0.4.43`) which is vulnerable to CVE-2026-33056. This vulnerability exists in `tar` versions `< 0.4.45`. When `PyOxidizer` extracts a Python distribution archive (e.g., via `python_distribution_extract()`), a maliciously crafted `.tar.zst` file can bypass intended extraction directory boundaries and arbitrarily modify the permissions of external directories on the host filesystem.
**Reproduction Steps:**

1. Create an external target directory on the host system with restricted permissions: `mkdir /tmp/victim && chmod 700 /tmp/victim`.
2. Craft a malicious `.tar.zst` archive (`evil.tar.zst`) that contains a directory entry pointing to `../../../../tmp/victim` with `0777` permissions in its header.
3. Run `PyOxidizer` (or a script calling `python_distribution_extract()`) to extract `evil.tar.zst` into a local destination folder.
4. Check the permissions of the external `/tmp/victim` directory: `stat -c "%a" /tmp/victim`.

**Observable Evidence / Impact:**
The extraction succeeds without throwing any path-traversal or permission errors. However, the permissions of the external `/tmp/victim` directory are silently escalated.

```text
project=PyOxidizer
archive=evil.tar.zst
mode_before=700
extract_ok=true
mode_after=777
```

**Suggested Mitigation:**
Please update the `tar` dependency in `Cargo.toml` to `>= 0.4.45`.

Start with Cargo.toml and inspect the pinned tar dependency used by python_distribution_extract() for archive extraction. Update the dependency to version 0.4.45 or later, then run the provided malicious .tar.zst reproduction and confirm that /tmp/victim remains at mode 700 rather than changing to 777.

Written by the indexing model from the issue text.