Rogue Dependency in Rust's append-only-vec Crate Compromises Code Safety

CVE-2026-77650

What is CVE-2026-77650?

The append-only-vec crate version 0.1.9 for Rust is vulnerable due to a rogue dependency that connects to a command-and-control server, allowing potential execution of arbitrary code. This vulnerability poses significant security risks, particularly in environments where the crate is included as part of a project. By leveraging this rogue dependency, attackers may exploit the build process to introduce malicious code, highlighting the importance of scrutinizing third-party components and dependencies in software development.

References