Executive brief
Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`
Affected products
- crates.io diesel
Junglewise Threat Intelligence
Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`
Severity: medium · CVSS 4 · Published 2026-05-19
Technologies: diesel (crates.io). Vendors: crates.io.
Related threats
- Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`
- Diesel use after free in SqliteConnection deserialize_readonly_database
- RUSTSEC-2026-0172 - Possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`
- Diesel argument injection in PostgreSQL COPY FROM and COPY TO
- Diesel unaligned data access in SqliteAggregate