Rust advisories / better-macro
Vulnerability HighRUSTSEC-2021-0077 · better-macro
RUSTSEC-2021-0077: `better-macro` has deliberate RCE to prove a point
Short answerA security vulnerability in the better-macro crate: `better-macro` has deliberate RCE to prove a point. GitHub rates it High. No fixed version: replace the crate or remove the affected code path.
| Crate | better-macro |
|---|---|
| Type | Vulnerability (code-execution) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High (GitHub rating) |
| Published | 2021-07-22 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2021-38196, GHSA-79wf-qcqv-r22r |
| Affected functions | better_macro::println |
What to do
- Find who pulls it in:
cargo tree -i better-macro. - Avoid the affected API (
better_macro::println), or replace the crate.
Details from the advisory
better-macro is a fake crate which is "Proving A Point" that proc-macros can run arbitrary code. This is not a particularly novel or interesting observation.
It currently opens https://github.com/raycar5/better-macro/blob/master/doc/hi.md which doesn't appear to have any malicious content, but there's no guarantee that will remain the case.
This crate has no useful functionality, and should not be used.
References
- Package: crates.io/crates/better-macro
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0077.html
- Web: github.com/raycar5/better-macro/blob/24ff1702397b9c19bbfa4c660e2316cd77d3b900/src/lib.rs#L36-L38
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?