{"id":"CVE-2026-30960","revision":null,"records":[{"revision":"42dd9ae1384c4cb1a095cd849bea7cb2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-30960","aliases":[],"title":"RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface","description":"rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.","state":0,"publishedAt":"2026-03-10T17:11:10.797+00:00","modifiedAt":"2026-03-10T17:58:17.359+00:00","affected":[{"ecosystem":"Vendor product","name":"rssn","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apich-Organization\",\n                    \"product\": \"rssn\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.2.9\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4,"severity":"CRITICAL"}],"references":["https://github.com/Apich-Organization/rssn/security/advisories/GHSA-9c4h-pwmf-m6fj","https://github.com/Apich-Organization/rssn/releases/tag/v0.2.9","https://rustsec.org/advisories/RUSTSEC-2026-0038.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-30960","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-30960","identifiers":["CVE-2026-30960"]},"retained":false,"historicalAffected":[]},{"revision":"30d673b376e6435daad626942b205f9c","observedAt":"2026-11-09T08:02:46.748+00:00","statement":{"source":"euvd","id":"EUVD-2026-10704","aliases":["CVE-2026-30960","GHSA-9c4h-pwmf-m6fj"],"title":"rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation…","description":"rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4,"severity":null}],"references":["https://github.com/Apich-Organization/rssn/security/advisories/GHSA-9c4h-pwmf-m6fj","https://github.com/Apich-Organization/rssn/releases/tag/v0.2.9","https://rustsec.org/advisories/RUSTSEC-2026-0038.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10704","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 10, 2026, 5:11:10 PM","dateUpdated":"Mar 10, 2026, 5:58:17 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-10704","identifiers":["EUVD-2026-10704","CVE-2026-30960","GHSA-9c4h-pwmf-m6fj"]},"retained":false,"historicalAffected":[]},{"revision":"bcda4e06f5a54b03b19922e3e7b455d4","observedAt":"2026-10-25T07:19:14.635+00:00","statement":{"source":"nvd","id":"CVE-2026-30960","aliases":[],"title":"rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation…","description":"rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.","state":0,"publishedAt":"2026-03-10T18:18:55.227+00:00","modifiedAt":"2026-06-17T10:33:13.723+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.4,"severity":"CRITICAL"}],"references":["https://github.com/Apich-Organization/rssn/releases/tag/v0.2.9","https://github.com/Apich-Organization/rssn/security/advisories/GHSA-9c4h-pwmf-m6fj","https://rustsec.org/advisories/RUSTSEC-2026-0038.html"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-30960","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-94","CWE-269","CWE-695","CWE-754"],"productCriteria":[],"sourceDates":{"published":"2026-03-10T18:18:55.227","lastModified":"2026-06-17T10:33:13.723"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-30960","identifiers":["CVE-2026-30960"]},"retained":false,"historicalAffected":[]},{"revision":"b153ccf81961405fa182d637bd993401","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-9c4h-pwmf-m6fj","aliases":["CVE-2026-30960","RUSTSEC-2026-0038"],"title":"RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface","description":"## Impact\n\n**Vulnerability Type**: \nImproper Control of Generation of Code ('Code Injection') (CWE-94) / Improper Check for Unusual or Exceptional Conditions (CWE-754) / Improper Input Validation (CWE-20) / Use of Low-Level Functionality (CWE-695) / Improper Privilege Management (CWE-269) / External Control of System or Configuration Setting (CWE-15).\n\n**Technical Details**:\nThe vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.\n\n## Who is Impacted?\n\n * Developers using the library as a dynamic linked library (.so, .dll, .dylib) in multi-language environments (e.g., Python, Node.js, C++).\n * Cloud Service Providers running the library in multi-tenant environments or automated model-training pipelines.\n * Users processing untrusted or third-party datasets/models that may trigger malicious JIT instruction generation.\nPatches\n * Affected versions: < 0.2.8\n * Patched version: 0.2.9\n\n## Workarounds\n\nIf you cannot upgrade immediately, please consider the following mitigations:\n * Strict Sandboxing: Run the library within a restricted sandbox (e.g., WebAssembly, Docker with non-root user, or seccomp profiles) to limit system call access.\n * Principle of Least Privilege: Ensure the process calling the library does not have administrative or root privileges.\n * Input Filtering: If possible, implement an application-level validation layer to sanitize any data passed to the CFFI interfaces.\n * Disable JIT (if applicable): If your workload allows, use the interpreter-only mode (if provided by the library) to bypass the JIT engine entirely.\nCVSS Score\n * Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n * Base Score: 9.4 (Critical)\n\n## References\n\n[Apich Organization Security Team Homepage](https://security.apich.org/)","state":0,"publishedAt":"2026-03-10T01:19:29+00:00","modifiedAt":"2026-03-10T18:48:54.054188+00:00","affected":[{"ecosystem":"crates.io","name":"rssn","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.2.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/Apich-Organization/rssn/security/advisories/GHSA-9c4h-pwmf-m6fj","https://nvd.nist.gov/vuln/detail/CVE-2026-30960","https://github.com/Apich-Organization/rssn","https://github.com/Apich-Organization/rssn/releases/tag/v0.2.9","https://rustsec.org/advisories/RUSTSEC-2026-0038.html"],"sourceUrl":"https://github.com/advisories/GHSA-9c4h-pwmf-m6fj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9c4h-pwmf-m6fj","identifiers":["GHSA-9c4h-pwmf-m6fj","CVE-2026-30960","RUSTSEC-2026-0038"]},"retained":false,"historicalAffected":[]},{"revision":"cbcaaca80dba45abadb62c601f6c2d9d","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0038","aliases":["CVE-2026-30960","GHSA-9c4h-pwmf-m6fj"],"title":"RustSec Advisory","description":"## Impact\n\n**Vulnerability Type**: \nImproper Control of Generation of Code ('Code Injection') (CWE-94) / Improper Check for Unusual or Exceptional Conditions (CWE-754) / Improper Input Validation (CWE-20) / Use of Low-Level Functionality (CWE-695) / Improper Privilege Management (CWE-269) / External Control of System or Configuration Setting (CWE-15).\n\n**Technical Details**:\nThe vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.\n\n## Who is Impacted?\n\n * Developers using the library as a dynamic linked library (.so, .dll, .dylib) in multi-language environments (e.g., Python, Node.js, C++).\n * Cloud Service Providers running the library in multi-tenant environments or automated model-training pipelines.\n * Users processing untrusted or third-party datasets/models that may trigger malicious JIT instruction generation.\nPatches\n * Affected versions: < 0.2.8\n * Patched version: 0.2.9\n\n## Workarounds\n\nIf you cannot upgrade immediately, please consider the following mitigations:\n * Strict Sandboxing: Run the library within a restricted sandbox (e.g., WebAssembly, Docker with non-root user, or seccomp profiles) to limit system call access.\n * Principle of Least Privilege: Ensure the process calling the library does not have administrative or root privileges.\n * Input Filtering: If possible, implement an application-level validation layer to sanitize any data passed to the CFFI interfaces.\n * Disable JIT (if applicable): If your workload allows, use the interpreter-only mode (if provided by the library) to bypass the JIT engine entirely.\n\n## References\n\n[Apich Organization Security Team Homepage](https://security.apich.org/)","state":0,"publishedAt":"2026-03-08T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:13.5577118+00:00","affected":[{"ecosystem":"crates.io","name":"rssn","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.1.20"},{"kind":"fixed","version":"0.2.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":null,"severity":null}],"references":["https://crates.io/crates/rssn","https://rustsec.org/advisories/RUSTSEC-2026-0038.html","https://github.com/Apich-Organization/rssn/commit/dea11c594f39db503e84a51f1e3c2a93f8baa8eb"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0038","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0038","identifiers":["RUSTSEC-2026-0038","CVE-2026-30960","GHSA-9c4h-pwmf-m6fj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4268898+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4268987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T10:21:22.8157744+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8157744+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T10:21:50.2500014+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4276529+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4276532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b0b0499af228434598651aa5d221386e","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T10:21:49.6403901+00:00","lastSuccessAt":"2026-11-10T10:21:49.637+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T10:21:49.637+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T10:21:23.1241572+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1241572+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T10:21:22.8858542+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8858542+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T10:21:23.1397622+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1397622+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T10:21:23.0142877+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.0142877+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}