GHSA-4fg7-vxc8-qx5w
rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
GHSA-4fg7-vxc8-qx5w is a vulnerability with no CVSS score yet in rage, published December 18, 2024. No source lists public exploit code. Fixed in rage 0.6.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.6.1rage +19 more
Description
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or to the following age APIs when the plugin feature flag is enabled:
age::plugin::Identity::from_str(or equivalentlystr::parse::<age::plugin::Identity>())age::plugin::Identity::default_for_pluginage::plugin::IdentityPluginV1::newage::plugin::Recipient::from_str(or equivalentlystr::parse::<age::plugin::Recipient>())age::plugin::RecipientPluginV1::new
On UNIX systems, a directory matching age-plugin-* needs to exist in the working directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ragecrates.io | 0.6.0 to 0.6.0 | 0.6.1 |
agecrates.io | 0.6.0 to 0.6.0 | 0.6.1 |
agecrates.io | 0.7.0 up to 0.7.2 | 0.7.2 |
agecrates.io | 0.8.0 up to 0.8.2 | 0.8.2 |
agecrates.io | 0.9.0 up to 0.9.3 | 0.9.3 |
agecrates.io | 0.10.0 to 0.10.0 | 0.10.1 |
agecrates.io | 0.11.0 to 0.11.0 | 0.11.1 |
ragecrates.io | 0.7.0 up to 0.7.2 | 0.7.2 |
ragecrates.io | 0.8.0 up to 0.8.2 | 0.8.2 |
ragecrates.io | 0.9.0 up to 0.9.3 | 0.9.3 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ragecrates.io | 0.10.0 to 0.10.0 | 0.10.1 |
ragecrates.io | 0.11.0 to 0.11.0 | 0.11.1 |
ragecrates.io | 0.6.0 up to 0.6.1 | 0.6.1 |
agecrates.io | 0.6.0 up to 0.6.1 | 0.6.1 |
agecrates.io | 0.10.0 up to 0.10.1 | 0.10.1 |
agecrates.io | 0.11.0 up to 0.11.1 | 0.11.1 |
ragecrates.io | 0.10.0 up to 0.10.1 | 0.10.1 |
ragecrates.io | 0.11.0 up to 0.11.1 | 0.11.1 |
ragecrates.io | 0.6.0 up to 0.6.1, 0.7.0 up to 0.7.2, 0.8.0 up to 0.8.2, 0.9.0 up to 0.9.3, 0.10.0 up to 0.10.1, 0.11.0 up to 0.11.1 | 0.6.10.7.20.8.20.9.30.10.10.11.1 |
agecrates.io | 0.6.0 up to 0.6.1, 0.7.0 up to 0.7.2, 0.8.0 up to 0.8.2, 0.9.0 up to 0.9.3, 0.10.0 up to 0.10.1, 0.11.0 up to 0.11.1 | 0.6.10.7.20.8.20.9.30.10.10.11.1 |
What each source reports
GitHub AdvisoriesNo score
rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or to the following age APIs when the plugin feature flag is enabled:
age::plugin::Identity::from_str(or equivalentlystr::parse::<age::plugin::Identity>())age::plugin::Identity::default_for_pluginage::plugin::IdentityPluginV1::newage::plugin::Recipient::from_str(or equivalentlystr::parse::<age::plugin::Recipient>())age::plugin::RecipientPluginV1::new
On UNIX systems, a directory matching age-plugin-* needs to exist in the working directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
- Record
GHSA-4fg7-vxc8-qx5w- Weakness
- CWE-25
- Updated
- 2026-11-02
OSVNo score
rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or to the following age APIs when the plugin feature flag is enabled:
age::plugin::Identity::from_str(or equivalentlystr::parse::<age::plugin::Identity>())age::plugin::Identity::default_for_pluginage::plugin::IdentityPluginV1::newage::plugin::Recipient::from_str(or equivalentlystr::parse::<age::plugin::Recipient>())age::plugin::RecipientPluginV1::new
On UNIX systems, a directory matching age-plugin-* needs to exist in the working directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
- Record
GHSA-4fg7-vxc8-qx5w- Weakness
- CWE-25
- Updated
- 2026-11-02
OSVRUSTSEC-2024-0432No score
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the rage CLI through an attacker-controlled
recipient or identity string, or an attacker-controlled plugin name via the -j flag.
On UNIX systems, a directory matching age-plugin-* needs to exist in the working
directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or
--age-plugin=identity-v1. The standard input includes the recipient or identity string,
and the random file key (if encrypting) or the header of the file (if decrypting). The
format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
- Record
RUSTSEC-2024-0432- Updated
- 2026-11-02
OSVRUSTSEC-2024-0433No score
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided through an attacker-controlled input to the following
age APIs when the plugin feature flag is enabled:
age::plugin::Identity::from_str(or equivalentlystr::parse::<age::plugin::Identity>())age::plugin::Identity::default_for_pluginage::plugin::IdentityPluginV1::new(theplugin_nameargument)age::plugin::Recipient::from_str(or equivalentlystr::parse::<age::plugin::Recipient>())age::plugin::RecipientPluginV1::new(theplugin_nameargument)
On UNIX systems, a directory matching age-plugin-* needs to exist in the working
directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or
--age-plugin=identity-v1. The standard input includes the recipient or identity string,
and the random file key (if encrypting) or the header of the file (if decrypting). The
format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
- Record
RUSTSEC-2024-0433- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w
rustsec.org/advisories/RUSTSEC-2024-0432.html
crates.io/crates/rage