RUSTSEC-2025-0150 `finch-rst` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finch to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reporting...

RUSTSEC-2025-0052 async-std has been discontinued

The async-std has been discontinued. Alternatives: - smol...

RUSTSEC-2025-0005 Out of bounds write triggered by crafted coverage data

Function grcov::covdir::getcoverage uses the unsafe function getuncheckedmut without validating that the index is in bounds. This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data...

RUSTSEC-2024-0405 op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic = msg = throw new...

RUSTSEC-2023-0037 crate has been renamed to `crypto_secretbox`

This crate has been forked/renamed from xsalsa20poly1305 to cryptosecretbox. The new repository location is at:...

RUSTSEC-2021-0158 XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute...

RUSTSEC-2026-0334 BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

Affected versions of bip322 accepted a BIP-322 proof created with an attacker-controlled private key as a valid signature for an unrelated victim P2WPKH or P2SH-P2WPKH address, allowing complete authentication bypass in applications using verifysimple, verifysimpleencoded, verifyfull, or...

RUSTSEC-2026-0039 `chrono_anchor` was removed from crates.io due to malicious code

The chronoanchor crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. The malicious crate had 1 version published on 2026-03-04 approximately 6 days before removal and had no evidence of actual downloads. There were no crates...

RUSTSEC-2025-0034 soundness issue and unmaintained

FastMap::get lacks sufficient checks to its parameter index and is used to unsafely get a Vec element. fastidmap is unmaintained...

RUSTSEC-2021-0157 Incorrect escaping for `url("")` functions in CSS style attributes

In some cases, quotation marks in CSS url functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filterstyleproperties is used. As an example, this snippet: html Would...