crates.io rage vulnerabilities

Latest crates.io rage CVEs

Newest publication first

1. GHSA-4fg7-vxc8-qx5w rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

   Published 2024-12-18

   Unknown

   A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or to the following age APIs when the plugin feature flag is enabled: ag...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.