CVE-2026-77651: Critical severity Rust crate/arrayref vulnerability
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects that compile with arrayref crate version 0.3.10 are exposed. The malicious behavior is triggered during compilation, so build systems and developer environments that resolve this version are relevant targets.
What does an attacker need to exploit it?
No privileges or user interaction are required according to the supplied vector. The rogue dependency registers with a command-and-control server and offers arbitrary code execution during compilation.
How can I determine whether a build is affected?
Check the dependency resolution used by the project or build for arrayref version 0.3.10. A project is affected if that version is selected during compilation.