RUSTSEC-2024-0432: Malicious plugin names, recipients, or identities can cause arbitrary binary execution

What to do

1. See which version you have: cargo tree -i rage (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rage. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rage = "0.9.3") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.

Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or an attacker-controlled plugin name via the -j flag.

On UNIX systems, a directory matching age-plugin-* needs to exist in the working directory for the attack to succeed.

The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.

An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.

Thanks to ⬡-49016 for reporting this issue.

References

• Package: crates.io/crates/rage
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0432.html
• Web: github.com/str4d/rage/commit/703152ecfa86f27952a35b57dd525ed39396a227

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.