CVE-2026-77650
CriticalCVSS 9.8Summary
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Risk Assessment
A developer compiling a project with this crate may unknowingly execute malicious code, potentially leading to compromise of the development environment and possibly the entire system.
Recommendation
It is recommended to immediately remove the append-only-vec crate version 0.1.9 from the project and replace it with a trusted alternative, and also scan the system for infections.
Original NVD description (English source)
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.