The attack is believed to be a nation-state level attack, and only the rogue developer and groups with which the compromised key has been shared would be able to gain access. As such, it is not likely to be widely exploited.
More information is available in our blog post here.
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73F1DAD7-F362-4C5B-B980-2E5313C369DA"
},
{
"criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55782A0B-B9C5-4536-A885-84CAB7029C09"
}
],
"operator": "OR"
}
]
}
]