CVE-2026-77650: append-only-vec crate malicious build script supply chain attack

CVE-2026-77650 · Severity: critical · CVSS 9.8 · Published 2026-08-21

The append-only-vec crate, a Rust library used in software projects, was compromised and published with a malicious build script that executes arbitrary code during compilation. When a developer builds a project that depends on the affected version, the malware downloads and runs executable code from an attacker-controlled server, potentially giving the attacker complete control over the developer's machine and any systems they deploy code to.

Technologies: append-only-vec (crates.io), arrayref (crates.io), internment (crates.io), proc-macro1 (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-77650 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77650 being exploited in the wild.
How severe is CVE-2026-77650?
Critical severity, with a CVSS score of 9.8, published 21 August 2026.
Which products and versions are affected?
append-only-vec (crates.io) 0.1.9; arrayref (crates.io) 0.3.10; internment (crates.io) 0.8.7; proc-macro1 (crates.io) 1.0.107.
Is there a fix for CVE-2026-77650?
A patch was published on 2026-08-20: Malicious versions removed and accounts locked by Rust Security Response Team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77650 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77650?
Check whether you run append-only-vec (crates.io), arrayref (crates.io), internment (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a supply chain attack via dependency injection in the Rust package ecosystem. The compromised append-only-vec 0.1.9 crate depends on a typosquatted rogue crate (proc-macro1) whose build.rs script downloads a malicious binary from 23.254.165.112:9089 and executes it during the build phase with no user interaction required. The payload is delivered as platform-specific executables (ELF on Unix, PowerShell on Windows) that connect to command-and-control servers. The attack affects the build environment of any developer or CI/CD system that compiles code depending on the malicious version. The malicious version was published on 2026-08-20 and remained accessible for 107 minutes before removal by the Rust Security Response Team.

Affected products

  • Rust append-only-vec 0.1.9
  • Rust proc-macro1 1.0.107
  • Rust arrayref 0.3.10
  • Rust internment 0.8.7

Timeline

  • 2026-08-20: disclosed: Malicious versions published to crates.io
  • 2026-08-20: other: append-only-vec 0.1.9 published
  • 2026-08-20: other: append-only-vec 0.1.9 deleted after 107 minutes online
  • 2026-08-20: patched: Malicious versions removed and accounts locked by Rust Security Response Team

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.