@domi it looks like Arch narrowly escaped being exploitable: https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2