diff --git a/src/shared/binary-downloader.ts b/src/shared/binary-downloader.ts
index 9b0ce7f04..d47d79062 100644
--- a/src/shared/binary-downloader.ts
+++ b/src/shared/binary-downloader.ts
@@ -116,6 +116,10 @@ async function listTarEntries(archivePath: string, cwd?: string): Promise<Archiv
   }
 
   if (exitCode !== 0) {
+    if (/Member name contains '\.\.'/i.test(stderr) || /Removing leading [`']\.\.\//i.test(stderr)) {
+      throw new Error(`tar archive contains path traversal entries: ${stderr}`)
+    }
+
     throw new Error(`tar entry listing failed (exit ${exitCode}): ${stderr}`)
   }