append-only-vec CVE-2026-77650

Exploitation requires that a target project declare a dependency on append-only-vec 0.1.9 (directly or transitively) and then compile it with cargo - the malicious code runs automatically during the build via the rogue dependency's build script/proc-macro, so no running service or network-facing endpoint is involved. Limiting factors: the victim must actually add and build the crate (it does not self-propagate to arbitrary hosts), only the specific 0.1.9 version is implicated, and offline/air-gapped or fully vendored build environments that never fetch this crate are not exposed. Any machine that does compile it (developer laptop or CI runner) is fully affected, and defenses like registry mirroring, cargo-vet/cargo-deny allowlists, or lockfile pinning to a safe version prevent the pull.

The published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N), but that vector overstates remote reachability: this is not a network-exploitable flaw in a running service - it triggers only when a developer or CI system adds the crate and compiles it, so realistic exploitation requires the victim to incorporate the dependency (effectively user interaction and local build context). Once incorporated, however, impact is severe and automatic: full arbitrary code execution on developer workstations and CI/CD runners, which is a high-value pivot into build pipelines and signing infrastructure. There is no EPSS score, KEV entry, or independent POC provided, so exploitation is best characterized as opportunistic dependency-confusion/typosquat targeting rather than mass internet scanning; the true blast radius depends entirely on how many downstream projects pinned 0.1.9. Given that a single poisoned build can compromise an entire release pipeline, any team that has 0.1.9 anywhere in its Cargo.lock should treat this as urgent regardless of the crate's small footprint.

An attacker publishes or hijacks the append-only-vec 0.1.9 crate containing a malicious build-time dependency, then waits for developers to add it (via typosquat, dependency confusion, or a compromised maintainer account). When a developer or CI pipeline runs 'cargo build', the embedded code executes with the builder's privileges, calls home to the C2 server, and grants the operator arbitrary code execution on the build host - potentially poisoning downstream release artifacts. No separate POC is needed because the crate itself is the weaponized payload.