The Rust Security Response WG was notified that Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to XSS if the report is subsequently uploaded somewhere.

The severity of this vulnerability is “low” for users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected.

Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerability in this advisory allows performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it’s possible to perform the same attacks with build scripts and procedural macros.

Overview

Rust 1.60.0 introduced cargo build --timings, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate.

Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names.

As the feature names were included unescaped in the timings report, they could be used to inject Javascript into the page, for example with a feature name like `features = ["<img src>