EUVD-2026-63779
GHSA-m5g8-cx2h-cvrh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Runs only when a developer adds the crate and compiles locally, so AV:L and UI:R rather than network-remote; full compromise of the build host gives C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
AnalysisAI
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a target project declare a dependency on append-only-vec 0.1.9 (directly or transitively) and then compile it with cargo - the malicious code runs automatically during the build via the rogue dependency's build script/proc-macro, so no running service or network-facing endpoint is involved. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N), but that vector overstates remote reachability: this is not a network-exploitable flaw in a running service - it triggers only when a developer or CI system adds the crate and compiles it, so realistic exploitation requires the victim to incorporate the dependency (effectively user interaction and local build context). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or hijacks the append-only-vec 0.1.9 crate containing a malicious build-time dependency, then waits for developers to add it (via typosquat, dependency confusion, or a compromised maintainer account). When a developer or CI pipeline runs 'cargo build', the embedded code executes with the builder's privileges, calls home to the C2 server, and grants the operator arbitrary code execution on the build host - potentially poisoning downstream release artifacts. … |
| Remediation | Because the released code is intentionally malicious rather than a fixed defect, the primary remediation is removal, not upgrade: purge append-only-vec 0.1.9 from every Cargo.toml and Cargo.lock, delete the cached copy from ~/.cargo/registry, and pin to a version explicitly marked safe in RUSTSEC-2026-0262 (verify the exact safe version against https://rustsec.org/advisories/RUSTSEC-2026-0262.html before re-adding). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all internal projects and CI/CD pipelines using append-only-vec version 0.1.9 through dependency scanning; immediately halt builds from affected projects; isolate and preserve build logs and artifacts for forensic analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-506 – Embedded Malicious Code
View allShare
External POC / Exploit Code
Leaving vuln.today