CVE-2026-77649

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77649", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-21T00:39:01.558Z", "datePublished": "2026-08-21T00:39:02.071Z", "dateUpdated": "2026-08-21T13:25:41.885Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "internment", "vendor": "droundy", "versions": [{"status": "affected", "version": "0.8.7", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-506", "description": "CWE-506 Embedded Malicious Code", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-21T00:39:02.071Z"}, "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0266.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T13:25:28.760292Z", "id": "CVE-2026-77649", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T13:25:41.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77649", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T13:25:28.760292Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T13:25:38.151Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "droundy", "product": "internment", "versions": [{"status": "affected", "version": "0.8.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0266.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-506", "description": "CWE-506 Embedded Malicious Code"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-21T00:39:02.071Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77649", "state": "PUBLISHED", "dateUpdated": "2026-08-21T13:25:41.885Z", "dateReserved": "2026-08-21T00:39:01.558Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-21T00:39:02.071Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "internment", "vendor": "droundy", "versions": [{"status": "affected", "version": "0.8.7", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}, {"lang": "es", "value": "La crate internment 0.8.7 para Rust puede desencadenar la ejecuci\u00f3n de c\u00f3digo malicioso al compilar un proyecto que utiliza la crate, porque tiene una dependencia maliciosa que se registra con un servidor de comando y control para ofrecer ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2026-77649", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77649", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T13:25:28.760292Z", "version": "2.0.3"}}]}, "published": "2026-08-21T01:17:01.837", "references": [{"source": "cve@mitre.org", "url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"source": "cve@mitre.org", "url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"source": "cve@mitre.org", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0266.html"}, {"source": "cve@mitre.org", "url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"source": "cve@mitre.org", "url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-506"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.8.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "internment", "source": "cna", "vendor": "droundy"}, "product": "internment", "vendor": "droundy"}], "created": "2026-08-21T04:15:04.807306+00:00", "title": "Malicious Build-Time Code Execution via Rogue Dependency in Internment Crate", "updated": "2026-08-21T12:08:25.438897+00:00", "vendors": ["droundy", "droundy$PRODUCT$internment"]}