This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-77650 →

UBUNTU-CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue...

Original description

The description as published by the source.

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:26.10 rust-append-only-vec

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS rust-append-only-vec

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report blog.rust-lang.org
report rustsec.org