RUSTSEC-2026-0175
`onering` 1.4.1 was removed from crates.io for malicious code
A new version of the onering crate was published with code that attempted to
exfiltrate both metadata and code from the project it was included within.
One malicious version was published on 2026-06-10, approximately six hours before removal. This crate has no dependencies on crates.io, and there is no evidence of actual usage of the compromised version.
Thanks to Charlie Eriksen for the report.
What each source reports
OSV No score
`onering` 1.4.1 was removed from crates.io for malicious code
A new version of the onering crate was published with code that attempted to
exfiltrate both metadata and code from the project it was included within.
One malicious version was published on 2026-06-10, approximately six hours before removal. This crate has no dependencies on crates.io, and there is no evidence of actual usage of the compromised version.
Thanks to Charlie Eriksen for the report.
- Record
RUSTSEC-2026-0175- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oneringcrates.io |
1.4.1 up to 1.4.2-0 | 1.4.2-0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0175 is a vulnerability with no CVSS score yet in onering, published June 10, 2026. No source lists public exploit code. Fixed in onering 1.4.2-0.