see $URL and the ensuing thread: - no CVE yet: cpio and tar don't escape filenames, which can be used to hide real archive contents - CVE-2023-39810: unpacking a cpio archive can escape the working directory (can be combined with the first to evade casual inspection prior to unpacking) - also no CVE: overwriting argv[0] with ANSI escapes will cause netstat -p to process them, such as this POC to lock the terminal: https://bugs.busybox.net/show_bug.cgi?id=15922 Upstream has addressed some, like https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641 for CVE-2023-39810, but no new release that incorporates that yet. Also this adds a new knob, ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION, which if I read correctly defaults to off so I think we'd need a busybox_config_option setting to enable it.
