GHSA-jgvr-6x5w-hx5w: Rust/kcl-lib vulnerability

Q: What input is required to trigger the failure?

An attacker or user must be able to feed a KCL program containing an expression wrapped in a sufficiently deep number of unnecessary parentheses. The nesting drives recursive parser calls until the process stack limit is exceeded.

Q: What is the practical impact of successful exploitation?

Successful exploitation causes a stack overflow in the parsing process. This can terminate or otherwise disrupt the affected process handling the crafted KCL input.

Published Aug 20, 2026

Updated

Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression -> unnecessarilybracketed -> expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.

Affected Software

2 affected componentsFixes available

rust/kcl-lib<0.2.129

0.3.129

pip/zoo-kcl<0.3.129

0.3.129

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/kcl-lib to a version that resolves this vulnerability.
Fixed in 0.3.129
Upgrade
Upgrade pip/zoo-kcl to a version that resolves this vulnerability.
Fixed in 0.3.129

Event History

Aug 20, 2026

Advisory Published

via GitHub·06:34 PM

Data Sourced

via GitHub·06:34 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What input is required to trigger the failure?

An attacker or user must be able to feed a KCL program containing an expression wrapped in a sufficiently deep number of unnecessary parentheses. The nesting drives recursive parser calls until the process stack limit is exceeded.

What is the practical impact of successful exploitation?