EUVD-2026-63778
GHSA-5g4x-qgj2-956v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Delivered via crates.io (AV:N) but only fires when a developer/CI adds and compiles the crate, so UI:R; full code execution on the build host gives C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
AnalysisAI
Build-time arbitrary code execution in the internment 0.8.7 crate for Rust: this specific published version was trojanized as part of the August 2026 arrayref/proc-macro1 Rust supply-chain campaign, pulling in a rogue transitive dependency that registers with a command-and-control server and executes attacker-supplied code on the developer or CI machine that compiles any project depending on it. Any Rust build that resolves internment 0.8.7 is affected, and because the payload runs during cargo build rather than at application runtime, compromise occurs before the target program is ever executed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a Rust project's dependency graph resolve internment at exactly version 0.8.7 and that the project then be compiled (cargo build/test/CI), because the payload lives in the crate's build/dependency execution path and fires at compile time, not runtime. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) treats this as fully remote and unauthenticated, but that scoring understates the required precondition: a developer or CI pipeline must add and compile a project that resolves internment 0.8.7, which is best modeled as user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer adds internment as a dependency (or updates a lockfile) such that version 0.8.7 is resolved, then runs cargo build or triggers a CI pipeline. During compilation the rogue transitive dependency executes, contacts the attacker's command-and-control server, and runs arbitrary commands on the build host - for example dumping environment secrets and CI tokens or implanting a backdoor. … |
| Remediation | No vendor-released fixed version number is provided in the input, so treat this as a malicious-release removal rather than a version bump: immediately remove or pin away from internment 0.8.7, delete it from Cargo.lock, and re-resolve to a known-good version, consulting https://rustsec.org/advisories/RUSTSEC-2026-0266.html for the specific safe range once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Cargo.lock and Cargo.toml files to identify projects using internment 0.8.7; isolate or air-gap affected build systems and developer machines from production networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Internment
View allAn issue was discovered in the internment crate through 2020-05-28 for Rust. Rated high severity (CVSS 8.1), this vulner
An issue was discovered in the internment crate before 0.4.2 for Rust. Rated critical severity (CVSS 9.8), this vulnerab
Same weakness CWE-506 – Embedded Malicious Code
View allShare
External POC / Exploit Code
Leaving vuln.today