Threats affecting pkg:github/google/fuse-archive

CVE-2026-87723 is an untrusted search path vulnerability in Google fuse-archive versions prior to 1.24. An attacker who can manipulate the PATH environment variable or place a malicious binary in a writable directory within PATH can hijack the execution flow to run arbitrary local code with the privileges of the user running fuse-archive. The vulnerability was partially mitigated in version 1.22 and fully fixed in version 1.24 by implementing refined selective PATH filtering.