It would seem according to these two sources that rar files can contain custom code thanks to the WinRAR virtual machine, which under normal circumstances may only access the data being uncompressed. What is intriguing however is that the following is mentioned in the RarVM Toolchain docs:
There are several known bugs in the RarVM.
[redacted as some have security consequences]
Should we start considering RAR files insecure?