CVE-2026-77651

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77651", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-21T00:41:35.750Z", "datePublished": "2026-08-21T00:41:36.099Z", "dateUpdated": "2026-08-21T13:17:52.920Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "arrayref", "vendor": "droundy", "versions": [{"status": "affected", "version": "0.3.10", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-506", "description": "CWE-506 Embedded Malicious Code", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-21T00:41:36.099Z"}, "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T13:17:41.622051Z", "id": "CVE-2026-77651", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T13:17:52.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77651", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T13:17:41.622051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T13:17:47.299Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "droundy", "product": "arrayref", "versions": [{"status": "affected", "version": "0.3.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}, {"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-506", "description": "CWE-506 Embedded Malicious Code"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-21T00:41:36.099Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77651", "state": "PUBLISHED", "dateUpdated": "2026-08-21T13:17:52.920Z", "dateReserved": "2026-08-21T00:41:35.750Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-21T00:41:36.099Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "arrayref", "vendor": "droundy", "versions": [{"status": "affected", "version": "0.3.10", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."}, {"lang": "es", "value": "El crate arrayref 0.3.10 para Rust puede desencadenar la ejecuci\u00f3n de c\u00f3digo malicioso al compilar un proyecto que utiliza el crate, porque tiene una dependencia maliciosa que se registra con un servidor de comando y control para ofrecer ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2026-77651", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77651", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T13:17:41.622051Z", "version": "2.0.3"}}]}, "published": "2026-08-21T01:17:02.140", "references": [{"source": "cve@mitre.org", "url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"}, {"source": "cve@mitre.org", "url": "https://github.com/rustsec/advisory-db/issues/3161"}, {"source": "cve@mitre.org", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html"}, {"source": "cve@mitre.org", "url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"}, {"source": "cve@mitre.org", "url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-506"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.10"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "arrayref", "source": "cna", "vendor": "droundy"}, "product": "arrayref", "vendor": "droundy"}], "created": "2026-08-21T04:30:09.571542+00:00", "title": "Supply\u2011Chain Attack on Rust arrayref Crate Enables Build\u2011Time Code Execution", "updated": "2026-08-21T12:08:22.258488+00:00", "vendors": ["droundy", "droundy$PRODUCT$arrayref"]}