CGA-6cxp-qqq9-5mq3

Upon further investigation, we have determined that this is not a security issue in the Python package itself. It's still possible to misuse the Python standard library, such as by supplying untrusted data to the tar extraction functions, in which case a vulnerability should be identified in the caller code.

Users should upgrade to version 3.12.0_beta1-r0 or later and set the filter parameter to 'data' when calling TarFile.extract and TarFile.extractall methods. For more information, see https://peps.python.org/pep-0706/.

The upstream issue has been closed, deeming this to be expected behavior, not a security issue. See https://bugs.python.org/issue1044.