crates.io arrayref vulnerabilities

Latest crates.io arrayref CVEs

Newest publication first

1. RUSTSEC-2026-0260 `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

   Published 2026-08-20

   Unknown

   A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constitut...

2. MAL-2026-14336 Malicious code in arrayref (crates.io)

   Published 2026-08-20

   Unknown

   arrayref 0.3.10 was published to crates.io from a maintainer account (droundy) that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compil...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.