Petr Viktorin (https://github.com/encukou)

tarfile hardlink fallback ignores custom extraction filter rejection via None

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

tarfile extraction filter bypass allows creation of directories outside the destination

Configuration Injection via Carriage Return (\r) in write() method

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

Quadratic Behavior in xml.etree.ElementPath Index Predicates

Tarfile.extract() doesn't fully respect filter parameter