https://lists.busybox.net/pipermail/busybox/2025-August/091665.html

I am happy to observe a 30-day embargo to coordinate with downstream distributions. Please let me know if you need more or less time.

🤦‍♀️

[SECURITY] busybox tar: TOCTOU symlink race overwrites arbitrary root file with --overwrite

@ariadne did they just report a vulnerability on a public mailing list?