CVE-2026-77650

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77650", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-21T00:40:26.113Z", "datePublished": "2026-08-21T00:40:26.467Z", "dateUpdated": "2026-08-21T13:20:06.921Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "append-only-vec", "vendor": "droundy", "versions": [{"status": "affected", "version": "0.1.9", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-506", "description": "CWE-506 Embedded Malicious Code", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-21T00:40:26.467Z"}, "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0262.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T13:18:56.634996Z", "id": "CVE-2026-77650", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T13:20:06.921Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T13:18:56.634996Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T13:19:08.463Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "droundy", "product": "append-only-vec", "versions": [{"status": "affected", "version": "0.1.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0262.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-506", "description": "CWE-506 Embedded Malicious Code"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-21T00:40:26.467Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77650", "state": "PUBLISHED", "dateUpdated": "2026-08-21T13:20:06.921Z", "dateReserved": "2026-08-21T00:40:26.113Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-21T00:40:26.467Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "append-only-vec", "vendor": "droundy", "versions": [{"status": "affected", "version": "0.1.9", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}, {"lang": "es", "value": "El crate append-only-vec 0.1.9 para Rust puede desencadenar la ejecuci\u00f3n de c\u00f3digo malicioso al compilar un proyecto que utiliza el crate, porque tiene una dependencia maliciosa que se registra con un servidor de comando y control para ofrecer ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2026-77650", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77650", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T13:18:56.634996Z", "version": "2.0.3"}}]}, "published": "2026-08-21T01:17:01.993", "references": [{"source": "cve@mitre.org", "url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"source": "cve@mitre.org", "url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"source": "cve@mitre.org", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0262.html"}, {"source": "cve@mitre.org", "url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"source": "cve@mitre.org", "url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-506"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.1.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "append-only-vec", "source": "cna", "vendor": "droundy"}, "product": "append-only-vec", "vendor": "droundy"}], "created": "2026-08-21T04:00:13.588830+00:00", "title": "Supply Chain Attack via Rogue Dependency in append\u2011only\u2011vec Crate", "updated": "2026-08-21T12:08:23.783217+00:00", "vendors": ["droundy", "droundy$PRODUCT$append-only-vec"]}