CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
https://github.com/rustsec/advisory-db/issues/3161
https://rustsec.org/advisories/RUSTSEC-2026-0260.html
https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/
https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El crate arrayref 0.3.10 para Rust puede desencadenar la ejecución de código malicioso al compilar un proyecto que utiliza el crate, porque tiene una dependencia maliciosa que se registra con un servidor de comando y control para ofrecer ejecución de código arbitrario.

Information

Published : 2026-08-21 01:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-77651

Mitre link : CVE-2026-77651

CVE.ORG link : CVE-2026-77651

JSON object : View

Products Affected

No product.

CWE

CWE-506

Embedded Malicious Code

{"id": "CVE-2026-77651", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77651", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T13:17:41.622051Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "droundy", "product": "arrayref", "versions": [{"status": "affected", "version": "0.3.10", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T01:17:02.140", "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref", "source": "cve@mitre.org"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161", "source": "cve@mitre.org"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html", "source": "cve@mitre.org"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/", "source": "cve@mitre.org"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-506"}]}], "descriptions": [{"lang": "en", "value": "The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}, {"lang": "es", "value": "El crate arrayref 0.3.10 para Rust puede desencadenar la ejecuci\u00f3n de c\u00f3digo malicioso al compilar un proyecto que utiliza el crate, porque tiene una dependencia maliciosa que se registra con un servidor de comando y control para ofrecer ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "cve@mitre.org"}