Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

rssn

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4crates.ioPublished

    RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

    CVE-2026-30960 · GHSA-9c4h-pwmf-m6fj

    Affected
    • crates.io rssn < 0.2.9
    Fixed in
    0.2.9· Vendor fix available
    Issue
    Impact Vulnerability Type: Improper Control of Generation of Code ('Code Injection') (CWE-94) / Improper Check for Unusual or Exceptional Conditions (CWE-754) / Improper Input Validation (CWE-20) / Use of Low-Level Functionality (CWE-695) / Improper Privilege Management (CWE-269) / External Control of System or Configuration Setting (CWE-15). Technical Details: The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process. Who is Impacted? Developers using the library as a dynamic linked library (.so, .dll, .dylib) in multi-language environments (e.g.,…

    Recommended action: Upgrade to 0.2.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →