CVE-2026-77650

Published: Ago 21, 2026 Last Modified: Ago 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

506

Embedded Malicious Code

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://blog.rust-lang.org/2026/08/20/supply-chain-attack-o…
https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
https://github.com/rustsec/advisory-db/issues/3161
https://github.com/rustsec/advisory-db/issues/3161
https://rustsec.org/advisories/RUSTSEC-2026-0262.html
https://rustsec.org/advisories/RUSTSEC-2026-0262.html
https://safedep.io/arrayref-proc-macro1-rust-build-time-mal…
https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/
https://www.stepsecurity.io/blog/arrayref-rust-crate-supply…
https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack