EUVD-2026-63780
GHSA-jvc2-9prg-ffvc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Crate is delivered over the network (AV:N) but requires the victim to depend on and compile it (UI:R); build-time execution yields full C:H/I:H/A:H on the host.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
AnalysisAI
Build-time malicious code execution in the arrayref Rust crate version 0.3.10 allows an attacker to run arbitrary code on any developer or CI machine that compiles a project depending on it. The compromised release pulls in a rogue transitive dependency that beacons to a command-and-control server and accepts arbitrary command execution, making this a confirmed supply-chain compromise disclosed by the Rust Security Response WG and RustSec (RUSTSEC-2026-0260). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Triggering requires that a target project actually declares or transitively resolves arrayref 0.3.10 and then compiles it (running `cargo build`, `cargo test`, or any build that invokes the crate's build script/proc-macro), and that the build host has outbound network access to reach the command-and-control server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) overstates the true access model: exploitation is not a remote unauthenticated network hit against a running service but requires a victim to add and compile the poisoned crate, which is functionally user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes the trojaned arrayref 0.3.10 to crates.io; a developer or CI system resolves it as a direct or transitive dependency and runs `cargo build`. The malicious build-time dependency executes automatically during compilation, calls out to the attacker's C2 server, and grants arbitrary command execution on the build host - allowing credential theft, lateral movement, or poisoning of produced binaries. … |
| Remediation | No vendor-released clean patch version is confirmed in the provided data; the primary action is to immediately stop using arrayref 0.3.10 and pin to a known-good prior release (verify the exact safe version against RUSTSEC-2026-0260 before pinning rather than trusting an assumed number). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all projects and CI pipelines to identify dependencies on arrayref version 0.3.10 using cargo-audit or equivalent tooling and analyze recent build logs from affected systems for signs of unauthorized access or external network connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-506 – Embedded Malicious Code
View allShare
External POC / Exploit Code
Leaving vuln.today