crates.io tracexec vulnerabilities

Latest crates.io tracexec CVEs

Newest publication first

1. GHSA-6fgx-x7m2-74qm tracexec has `env` command argument injection via environment variables starting with dash in traced exec events

   Published 2025-10-13

   Low·CVSS 1.0

   Impact For tracexec's command line reconstruction feature, when a traced process executes another process with a environment variable where the key starts with a dash, tracexec incorrectly shows its commandline where such environment variables could cause argument injection for t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.