Cargo downloads a Rust projectβs dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrary ...
6.1CVSS
7AI Score
0.003EPSS