CVE-2026-77650
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.43%
- CWE
- CWE-506
- Published
- 2026-08-21
- Last modified
- 2026-08-21
Affected products
- droundy append-only-vec
Weakness type
Related vulnerabilities
- CVE-2026-74232 — Zbtlink MQWrt yunmgrd Cloud C2 Implant
- CVE-2026-77651 — The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project...
- CVE-2026-77649 — The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a...
- CVE-2026-73532 — Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
- CVE-2026-73533 — Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
- CVE-2026-48161 — react18-use was vulnerable to malicious code execution via compromised commits
- CVE-2026-48160 — react-tracked was vulnerable to malicious code execution via compromised commits
- CVE-2026-48159 — use-reducer-async was vulnerable to malicious code execution via compromised commits