RUSTSEC-2025-0165: i_tree allowed out-of-bounds access through safe public node accessors

What to do

1. See which version you have: cargo tree -i i_tree (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p i_tree. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example i_tree = "0.10.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of i_tree exposed safe public Tree::node and Tree::mut_node methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::get_unchecked / get_unchecked_mut on the internal node buffer, without validating that the index was in bounds.

Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any unsafe code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.

Starting with 0.10.0 the crate was restructured and these accessors are no longer reachable from outside the crate.

References

• Package: crates.io/crates/i_tree
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0165.html
• Report: github.com/iShape-Rust/iTree/issues/1
• Web: github.com/iShape-Rust/iTree/commit/a948b891cf159233bfed5b16bf185268fd9e1985
• Web: github.com/iShape-Rust/iTree/compare/0.9.0...0.10.0

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.