[sunshowers]

Affected crate(s)

• cargo-nextest (1.8m+ recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

GHSA-vc25-qg58-w57c

Severity

Nextest versions between 0.9.125 and 0.9.149 (inclusive) allow the cargo nextest run --rerun (or -R) command with a malicious portable recording to run arbitrary code during the build. The result is arbitrary code execution with the privileges of the user running cargo nextest.

This vulnerability requires that the experimental run recording functionality is enabled. An attacker can plausibly trick a victim into enabling this feature.

This is a 7.8 High vulnerability: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (I am the maintainer)

[djc]

Thanks!