HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.
https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
https://github.com/hashicorp/go-slug/pull/12
https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0