pythonnative
diff --git a/src/pythonnative/project/runtime_assets.py b/src/pythonnative/project/runtime_assets.py
@@ -80,20 +80,37 @@ def _sha256(path: Path) -> str:
 
 
 def _safe_extract(tar_path: Path, dest: Path) -> None:
-    """Extract a tarball, refusing entries that escape ``dest``."""
+    """Extract a tarball, refusing entries that escape ``dest``.
+
+    Preflight checks reject unsafe paths, link targets, and special files.
+    The data filter also checks each member during extraction, accounting
+    for links created by earlier members and sanitizing file permissions.
+    """
     dest = dest.resolve()
     with tarfile.open(tar_path, "r:gz") as tar:
         members = tar.getmembers()
         for member in members:
             target = (dest / member.name).resolve()
-            if not str(target).startswith(str(dest)):
+            # ``is_relative_to`` compares path components. A string prefix
+            # test would accept a sibling whose name merely starts with
+            # ``dest``, such as ``../out-evil/x.txt`` beside ``out/``.
+            if not target.is_relative_to(dest):
                 raise RuntimeError(f"Refusing to extract unsafe path: {member.name}")
-        # ``filter='data'`` (3.12+) blocks unsafe members; older Pythons
-        # fall back to the manual check above.
-        try:
-            tar.extractall(dest, filter="data")
-        except TypeError:
-            tar.extractall(dest)
+            if member.issym() or member.islnk():
+                # A link's name can be innocuous while its target escapes.
+                # Symlink targets resolve against the link's own directory;
+                # hardlink targets are relative to the archive root.
+                base = target.parent if member.issym() else dest
+                link_target = (base / member.linkname).resolve()
+                if not link_target.is_relative_to(dest):
+                    raise RuntimeError(f"Refusing to extract unsafe link: {member.name} -> {member.linkname}")
+            if member.isdev():
+                # The pinned archives only need files, directories, and
+                # links, so refuse FIFOs and device nodes before extraction.
+                raise RuntimeError(f"Refusing to extract special file: {member.name}")
+        # Every supported interpreter provides the data filter. Keep it
+        # explicit because Python 3.13 defaults to unfiltered extraction.
+        tar.extractall(dest, filter="data")
 
 
 def _locate_runtime(extract_root: Path, python_version: str) -> IOSRuntime: