VulnerabilityRUSTSEC-2026-0260 · arrayref
RUSTSEC-2026-0260: `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
Short answerA security vulnerability in the arrayref crate: `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency. No severity score was published. No fixed version: replace the crate or remove the affected code path.
| Crate | arrayref |
|---|---|
| Type | Vulnerability (malicious) |
| Affected versions | From 0.3.10 onward (every version). |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-08-20 |
| Last changed | 2026-08-21 |
| Also known as | none |
What to do
- Find who pulls it in:
cargo tree -i arrayref. - Avoid the affected API, or replace the crate.
Details from the advisory
A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.
This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% of arrayref download traffic across all versions, as most users had older versions of arrayref in their lockfiles.
References
- Package: crates.io/crates/arrayref
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0260.html
- Web: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for arrayref
Up next
Same cratearrayref: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?