CVE-2026-77651
CriticalCVSS 9.8Summary
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Risk Assessment
A developer compiling a project with this crate may unknowingly execute malicious code, potentially leading to compromise of the development environment and possibly the entire system.
Recommendation
It is recommended to immediately remove the arrayref crate version 0.3.10 from the project and replace it with a trusted alternative, and also scan the system for infections.
Original NVD description (English source)
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.