zarf-dev zarf

• CVE-2026-40090 High 7.1 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write 0.3%
• CVE-2026-29064 High 8.2 Zarf: Symlink targets in archives are not validated against destination directory 0.3%