RUSTSEC-2026-0260
`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
A new version of the arrayref crate was published with a direct dependency
on proc-macro1, which would execute a malicious build script.
This compromised version was published on 2026-08-20 and removed approximately
86 minutes later. It was downloaded 2,285 times, which constituted less than
10% of arrayref download traffic across all versions, as most users had older
versions of arrayref in their lockfiles.
What each source reports
OSV No score
`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
A new version of the arrayref crate was published with a direct dependency
on proc-macro1, which would execute a malicious build script.
This compromised version was published on 2026-08-20 and removed approximately
86 minutes later. It was downloaded 2,285 times, which constituted less than
10% of arrayref download traffic across all versions, as most users had older
versions of arrayref in their lockfiles.
- Record
RUSTSEC-2026-0260- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
arrayrefcrates.io |
0.3.10-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0260 is a vulnerability with no CVSS score yet in arrayref, published August 20, 2026. No source lists public exploit code. No source names a fixed version.