diff --git a/src/align.py b/src/align.py
index eb24232..519806e 100755
--- a/src/align.py
+++ b/src/align.py
@@ -249,7 +249,26 @@ def main(args):
     if merged_R2 and args.endedness == "paired":
         fastqs.append(merged_R2)
     with tarfile.open(args.index, "r:gz") as archive:
-        archive.extractall()
+        def is_within_directory(directory, target):
+            
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+        
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+            
+            return prefix == abs_directory
+        
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+        
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+        
+            tar.extractall(path, members, numeric_owner=numeric_owner) 
+            
+        
+        safe_extract(archive)
     aligner = make_aligner(
         args.endedness, fastqs, args.ncpus, args.ramGB, args.indexdir
     )
diff --git a/src/rsem_quant.py b/src/rsem_quant.py
index 68cd7a1..b217181 100755
--- a/src/rsem_quant.py
+++ b/src/rsem_quant.py
@@ -89,7 +89,26 @@ def main(args):
     remove_bam_from_end_re = re.compile("\.bam$")
     bam_root = remove_bam_from_end_re.sub("", os.path.basename(args.anno_bam))
     with tarfile.open(args.rsem_index, "r:gz") as archive:
-        archive.extractall(".", members=make_modified_TarInfo(archive, "rsem_index"))
+        def is_within_directory(directory, target):
+            
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+        
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+            
+            return prefix == abs_directory
+        
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+        
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+        
+            tar.extractall(path, members, numeric_owner=numeric_owner) 
+            
+        
+        safe_extract(archive, ".", members=make_modified_TarInfo(archive,"rsem_index"))
     rsem_call = shlex.split(
         RSEM_COMMAND.format(
             rnd_seed=args.rnd_seed,