The latest updates for simplearchiver adds option --non-interactive. This option is required when extracting/testing archives that require a decompressor command to continue AND MUST ONLY BE USED WHEN THE USER IS ABSOLUTELY CERTAIN THAT THE DECOMPRESSOR COMMAND IS SAFE TO RUN. Otherwise, simplearchiver will emit an error message and will note the decompressor command. The user is expected to verify that the decompressor command is as expected before continuing with the --non-interactive flag.
Note that all versions prior to 4.0.0 of simplearchiver is potentially vulnerable to a malicious decompressor command as these prior versions will automatically use the decompressor command without pause (should one exist in the archive). In other words, all versions of simplearchiver prior to 4.0.0 will run the "decompressor command" without checking during extraction/testing (with -x option or -t option).
Whenever an archive is created with simplearchiver, if compression is desired, the user would specify --compressor <command> and --decompressor <command>. simplearchiver would then store both commands in the archive itself, and run the compressor command specified to store in the archive. When extracting/ testing, and if the decompressor was specified during archive creation, then simplearchiver would just automatically use the decompressor command, which was a mistake to do so unchecked. (Note there is a way to override the decompressor command by using --decompressor <command> during extraction/testing.)
The fix is as mentioned a --non-interactive flag to set, and MUST ONLY BE SET AFTER CHECKING THE DECOMPRESSOR COMMAND. The error message emitted when --non-interactive is required should note the decompressor command to check. Again, if necessary, the decompressor command can be overridden with --decompressor <command> when extracting/testing.
The expected use-case behavior should be to run simplearchiver as usual without the --non-interactive flag, and should the error message (noting --non-interactive) be emitted, the user should check the decompressor command to ensure it is valid/safe, and then the user should run the command again with the --non-interactive flag set. If the command is deemed to be unsafe, the user has the option to force the decompressor command used with --decompressor.
By the time this writeup is published, vulnerable versions of simplearchiver should no longer be available. Versions 4.0.0 and up will remain. If you are having trouble recovering data from an archive that has been tampered with, you may try (with caution) to use an eariler 4 series version as they are less strict than the very latest version.