CVE-2026-77650: Critical severity append-only-vec vulnerability
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects that compile with append-only-vec crate version 0.1.9 are exposed. The issue occurs during compilation because the crate includes a rogue dependency.
What does an attacker need to exploit it?
No privileges or user interaction are required according to the supplied severity vector. The malicious dependency registers with a command-and-control server and offers arbitrary code execution during compilation.
How can I determine whether my project is affected?
Check your dependency resolution for append-only-vec version 0.1.9, including transitive dependencies. A project is affected if that version is present and compiled.