CVE-2026-33056 Rust/Cargo tar-rs arbitrary directory chmod via symlink — fixed in Rust 1.94.1

CVE-2026-33056 (CVSS 5.1 MEDIUM) affects tar-rs <= 0.4.44. The unpack_in function follows symlinks when checking if a path is a directory, allowing a crafted tarball to chmod arbitrary directories on the filesystem when Cargo extracts a malicious crate during a build. Fixed in tar-rs 0.4.45, shipped in Rust 1.94.1 (released March 26, 2026). crates.io was patched on March 13 to block uploading exploiting crates. All previously published crates were audited. Severity is MEDIUM since exploitation requires user interaction (building a malicious crate). ODS developers upgrading to Rust 1.94.1 are protected.