crates.io rustpython-vm vulnerabilities

Latest crates.io rustpython-vm CVEs

Newest publication first

1. RUSTSEC-2026-0394 Build environment compiled into the library and readable at runtime

   Published 2026-09-23

   Unknown

   The build script of rustpython-vm 0.3.0 through 0.5.0 writes every environment variable of the build into $OUT_DIR/env_vars.rs. The crate compiles that file into _sysconfigdata's build_time_vars. That module is always compiled. A binary built in CI with secrets in the environment...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.