Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

cargo-nextest

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.8crates.ioPublished

    Arbitrary code execution when rerunning tests from a portable recording

    GHSA-vc25-qg58-w57c

    Affected
    • crates.io cargo-nextest >= 0.9.125, < 0.9.150
    Fixed in
    0.9.150· Vendor fix available
    Issue
    Nextest versions between 0.9.125 and 0.9.149 (inclusive) allow the `cargo nextest run --rerun` (or `-R`) command with a malicious portable recording to run arbitrary code during the build. The result is arbitrary code execution with the privileges of the user running `cargo nextest`. This vulnerability requires that the experimental run recording functionality is enabled. An attacker can plausibly trick a victim into enabling this feature. Details Nextest's portable recordings contain build scope arguments. These arguments are deserialized verbatim from portable recordings, and are not validated. As a result, it is possible to…

    Recommended action: Upgrade to 0.9.150 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →