Command-and-Control Vulnerability in arrayref for Rust by The Rust Project

CVE-2026-77651

What is CVE-2026-77651?

The arrayref crate version 0.3.10 for Rust is susceptible to exploitation due to a rogue dependency that connects to a command-and-control server. This vulnerability allows attackers to execute arbitrary code during the compilation of projects using the crate, posing a significant risk to the integrity and security of software built with it. Developers relying on this crate should take immediate action to mitigate the risk of supply chain attacks.

References