crates.io Advisories.

gix-sec safe.directory protections absent for elevated administrators

• CWE-283

<0.13.3 · fixed in 0.13.3

`unzip`: archive extraction is vulnerable to path traversal (zip-slip)

>=0.0.0-0 · no fixed version yet

Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics

>=0.0.0-0 · no fixed version yet

Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics

>=0.0.0-0, <0.3.1 · fixed in 0.3.1

SWC HTML minifier may allow script element breakout when minifying embedded JSON

• Cross-site scripting (XSS)
• CWE-116

<59.0.0 · fixed in 59.0.0

`WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`

>=0.20.0, <0.25.0 · fixed in 0.25.0

`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

>=1.3.1-dev.34027618345, <1.3.1-dev.34027618345.0 · fixed in 1.3.1-dev.34027618345.0

`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

>=1.3.34027618345, <1.3.34027618346-0 · fixed in 1.3.34027618346-0

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

• Broken access control

<3.2.0 · fixed in 3.2.0

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

• Broken access control

<3.2.0 · fixed in 3.2.0

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

• Code injection

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

• Code injection
• Broken access control

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

• Command injection
• Information disclosure

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning

• Server-side request forgery (SSRF)

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

• Information disclosure
• CWE-526

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

• Path traversal
• Command injection

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

• Privilege escalation

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

• Path traversal
• Information disclosure

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

• Path traversal

>=0.8.41, <0.8.64 · fixed in 0.8.64

SurrealDB allows bypass of deny-net flags via DNS resolution

• Broken access control
• CWE-923

>=2.1.0, <2.1.8 || >=2.2.0, <2.2.6 || >=2.3.0, <2.3.6 || >=3.0.0-alpha.1, <3.0.0-alpha.7 · fixed in 2.1.8, 2.2.6, 2.3.6, 3.0.0-alpha.7

Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics

>=0.0.0-0, <0.2.0 · fixed in 0.2.0

Hurl: Cookies in Cookies section leak when redirecting to a different host

• Information disclosure

<=8.0.1 · no fixed version yet

Use-after-free in `clear` and `retain` when an element's `Drop` panics

>=0.0.0-0, <1.1.1 · fixed in 1.1.1

`zbus_polkit`: authorization bypass via PID reuse

• Race condition
• CWE-686

>=0.0.0-0, <5.1.0 · fixed in 5.1.0

Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

• Denial of service

<0.8.0 · fixed in 0.8.0

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

• Information disclosure
• Memory corruption

<0.7.0 · fixed in 0.7.0

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

• Denial of service

>=0.1.0, <0.3.3 · fixed in 0.3.3

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

• Memory corruption

<0.21.5 · fixed in 0.21.5

Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)

>=0.0.0-0, <0.8.2 · fixed in 0.8.2

Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

>=0.0.0-0 · no fixed version yet

Path traversal in apimock's file-serving fallback

>=0.0.0-0, <4.8.1 || >=5.0.0, <5.0.0 · fixed in 4.8.1, 5.0.0

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

• CWE-345

>=0.22.0, <0.22.5 · fixed in 0.22.5

vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

• Denial of service

<0.3.2 · fixed in 0.3.2

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

• Memory corruption

>=0.4.0, <0.7.18 · fixed in 0.7.18

postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

• CWE-20
• CWE-248

<0.6.12 · fixed in 0.6.12

postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

• Denial of service

>=0.3.0, <0.6.12 · fixed in 0.6.12

Rejected authentication challenges can poison the Key Vault scope cache

>=0.10.0, <1.0.1 · fixed in 1.0.1

Rejected authentication challenges can poison the Key Vault scope cache

>=0.10.0, <1.0.1 · fixed in 1.0.1

Rejected authentication challenges can poison the Key Vault scope cache

>=0.9.0, <1.0.1 || >=1.1.0-beta.0, <1.1.0-beta.2 · fixed in 1.0.1, 1.1.0-beta.2

Panic on Decoding Short Hybrid Keys

>=0.0.0-0, <0.0.10 · fixed in 0.0.10

Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

>=0.0.0-0, <0.4.3 · fixed in 0.4.3

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

• Race condition
• Memory corruption

<0.2.153 · fixed in 0.2.153

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

• Denial of service

<0.3.129 · fixed in 0.3.129

`internment` 0.8.7 was removed from crates.io due to a malicious dependency

>=0.8.7-0 · no fixed version yet

`proc-macro1` was removed from crates.io due to malicious code

>=0.0.0-0 · no fixed version yet

`proc-macro-en` was removed from crates.io due to malicious code

>=0.0.0-0 · no fixed version yet

`tinymember` was removed from crates.io due to affiliation with malicious code

>=0.0.0-0 · no fixed version yet

`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency

>=0.1.9, <0.1.10-0 · fixed in 0.1.10-0

`aronenao` was removed from crates.io due to malicious code

>=0.0.0-0 · no fixed version yet

`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

>=0.3.10-0 · no fixed version yet

`arone` was removed from crates.io due to malicious code

>=0.0.0-0 · no fixed version yet

Guest controlled-size host heap allocation through WASIp3 streams

• Denial of service

>=46.0.0, <46.0.3 || >=47.0.0, <47.0.4 · fixed in 46.0.3, 47.0.4

Filesystem sandbox escape when paths or symlinks contain trailing slashes

• CWE-61

>=0.0.0-0, <24.0.13 || >=25.0.0, <36.0.14 || >=37.0.0, <46.0.3 || >=47.0.0, <47.0.4 · fixed in 24.0.13, 36.0.14, 46.0.3, 47.0.4

block_buffer: panic corrupts inline buffer position

• Memory corruption

>=0.11.0, <0.12.1 · fixed in 0.12.1

Triton VM Soundness Vulnerability due to Missing Constraint

• CWE-345

>=0.42.0-alpha.4, <4.0.0 · fixed in 4.0.0

FTP command injection via CRLF in control channel arguments

>=0.0.0-0, <10.0.2 · fixed in 10.0.2

Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

>=0.11.15, <0.11.17 · fixed in 0.11.17

h2 unbounded empty DATA frames

>=0.0.0-0, <0.4.16 · fixed in 0.4.16

Unbounded growth of pending connection ID retirements in quinn-proto

>=0.6.0, <0.11.17 · fixed in 0.11.17

Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto

>=0.5.0, <0.11.17 · fixed in 0.11.17