RUSTSEC-2026-0261 `aronenao` was removed from crates.io due to malicious code

We identified that aronenao contained malicious code executed through a build script. This crate had 11 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io and the user account was locked. This crate was used as part of a malware campaign targete...

RUSTSEC-2026-0260 `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...

RUSTSEC-2026-0264 `proc-macro-en` was removed from crates.io due to malicious code

We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...

RUSTSEC-2026-0262 `append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency

A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was use...

`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency

A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was use...

`arone` was removed from crates.io due to malicious code

We identified that arone contained malicious code executed through a build script. This crate had 7 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io on 2026-08-20 and the user account was locked. This crate was used as part of a malware campai...

RUSTSEC-2026-0265 `proc-macro1` was removed from crates.io due to malicious code

It was reported proc-macro1 contained a build script that would download a malicious payload. This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users ...

`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...

`aronenao` was removed from crates.io due to malicious code

We identified that aronenao contained malicious code executed through a build script. This crate had 11 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io and the user account was locked. This crate was used as part of a malware campaign targete...

`proc-macro-en` was removed from crates.io due to malicious code

We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...

`proc-macro1` was removed from crates.io due to malicious code

It was reported proc-macro1 contained a build script that would download a malicious payload. This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users ...

poc-inteligencia-tributaria-palmas

PoC — Inteligência Tributária de Palmas-TO !CIhttps://git...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

EUVD-2026-63264

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075

n8n's editor splices resource-locator field values into node URL templates without expression-syntax checks, enabling an authenticated user to inject JavaScript evaluated in another user's session. CVSS 8.4 HIGH. Affected: <1.123.69, 2.x <2.33.4, 2.34.x

CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

EUVD-2026-63261

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

CVE-2026-77072

n8n before 1.123.69 , 2.33.4 , and 2.34.1 contains a stored cross-site scripting (XSS) vulnerability in the Form node's completion page . The root cause is a logic flaw: the sandboxing Content-Security-Policy was applied only when respondWith was not set to 'redirect', yet responseText was always...