RUSTSEC-2024-0448: `parse_arguments` reads a caller-supplied pointer as a slice

What to do

1. See which version you have: cargo tree -i rutie (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rutie. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rutie = "0.14.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

parse_arguments is safe. It takes arguments: *const AnyObject and argc, and calls slice::from_raw_parts(arguments, argc as usize).

It does not check that arguments is non-null and aligned, or that argc elements are initialized. Safe Rust can pass a null pointer or a length past the allocation. The maintainer confirmed this on 2026-10-03, including a debug abort on Rust 1.78+ when Ruby calls an arity -1 method (to_s via format, puts, or Array#join) with a NULL argv and argc of 0.

References

• Package: crates.io/crates/rutie
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0448.html
• Report: github.com/danielpclark/rutie/issues/190

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.