CVE-2026-77650 Overview
CVE-2026-77650 affects the append-only-vec crate version 0.1.9 for Rust. The crate contains a rogue transitive dependency that executes malicious code during project compilation. The embedded payload contacts a command-and-control (C2) server and offers arbitrary code execution on the developer's build machine. This vulnerability is part of the broader Rust supply chain attack targeting the arrayref ecosystem. Any developer or continuous integration (CI) pipeline that resolves this crate as a direct or transitive dependency risks build-time compromise. The issue is classified under CWE-506: Embedded Malicious Code.
Critical Impact
Compiling any Rust project that pulls in append-only-vec 0.1.9 triggers unauthenticated remote code execution against the developer or build agent through a hidden C2 channel.
Affected Products
- append-only-vec crate version 0.1.9 (Rust)
- Rust projects transitively depending on the malicious crate through the compromised arrayref supply chain
- Continuous integration and build systems that resolve Cargo dependencies from crates.io
Discovery Timeline
- 2026-08-20 - Rust Security Response WG publishes advisory on the arrayref supply chain attack
- 2026-08-21 - CVE-2026-77650 published to the National Vulnerability Database (NVD)
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-77650
Vulnerability Analysis
The vulnerability originates in the dependency graph of append-only-vec 0.1.9, not in the crate's own source logic. When Cargo resolves and compiles the project, a malicious transitive dependency executes code inside a procedural macro or build script. Procedural macros and build.rs scripts run with the full privileges of the user invoking cargo build. The rogue dependency abuses this trust boundary to reach out to an attacker-controlled C2 endpoint.
Once contact is established, the C2 server can deliver arbitrary commands for execution. Reported behavior in related coverage from SafeDep and StepSecurity points to credential harvesting, source code exfiltration, and follow-on payload staging. The impact extends beyond the developer workstation to any downstream artifact produced by the poisoned build.
Root Cause
The root cause is embedded malicious code [CWE-506] introduced through a compromised dependency in the Rust ecosystem. Cargo does not sandbox build.rs or proc-macro execution, so any transitive dependency can run arbitrary code at compile time. Attackers exploited this design to distribute a trojanized version through the crates.io registry.
Attack Vector
Exploitation requires no user interaction beyond a normal cargo build, cargo test, or cargo check invocation. An attacker who publishes or hijacks a crate in the dependency chain gains code execution on every machine that compiles a dependent project. The Rust Security Advisory and RUSTSEC-2026-0262 document the specific crates and versions involved. Refer to the advisories for indicators; no verified exploit code is republished here.
Detection Methods for CVE-2026-77650
Indicators of Compromise
- Presence of append-only-vec = "0.1.9" in Cargo.lock or resolved dependency graphs
- Outbound network connections from rustc, cargo, or build-script-build processes during compilation
- Unexpected child processes spawned by procedural macro execution on developer or CI hosts
- Cargo registry pulls referencing the compromised arrayref ecosystem crates listed in RUSTSEC-2026-0262
Detection Strategies
- Run cargo audit with an updated advisory database to flag append-only-vec 0.1.9 and related crates
- Inspect Cargo.lock files across repositories for the malicious version pin
- Monitor build hosts for process lineage where cargo spawns network clients or shell interpreters
- Correlate DNS and HTTP telemetry from build agents against advisory-published C2 indicators
Monitoring Recommendations
- Enable endpoint telemetry on developer workstations and CI runners to capture process, file, and network events
- Alert on any outbound connection from build tooling to previously unseen domains
- Retain build logs and dependency manifests for retrospective hunts once new indicators are published
How to Mitigate CVE-2026-77650
Immediate Actions Required
- Remove append-only-vec 0.1.9 from all projects and pin to a version confirmed clean by the Rust Security Response WG
- Rotate credentials, API tokens, and SSH keys accessible from any host that compiled a vulnerable project
- Rebuild and re-sign any artifacts produced by potentially compromised pipelines
- Audit git history and CI logs for signs of exfiltration or lateral movement
Patch Information
The maintainers and the Rust Security Response WG have yanked the malicious release. Upgrade to a known-good version of append-only-vec as identified in RUSTSEC-2026-0262. Regenerate Cargo.lock after upgrading to ensure the malicious transitive dependency is fully evicted from the resolution graph.
Workarounds
- Vendor dependencies with cargo vendor and review third-party crates before building in trusted environments
- Execute Cargo builds inside isolated, network-restricted containers to contain build-time code execution
- Enforce allowlists for outbound traffic from CI runners so that unexpected C2 callbacks fail closed
- Integrate cargo-deny and cargo-audit into pull request checks to block reintroduction of banned crate versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
