Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent getenv operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment.
Recommended action: Upgrade to 0.2.153 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression - unnecessarilybracketed - expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.
Recommended action: Upgrade to 0.3.129 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.