{"id":"RUSTSEC-2026-0418","revision":null,"records":[{"revision":"c5cdd015105f40e48e3c378e17a43d63","observedAt":"2026-10-29T15:13:59.832+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0418","aliases":["GHSA-8p3x-q3q3-q3v5"],"title":"libz-sys build script leaks environment variables in the build directory","description":"The build script of `libz-sys` version <= 1.1.30 prints the full environment\nof the build, including any secrets it contains, to its stdout when compiled\nwith `cc@1.6.0` or later on a Unix host. This affects any build that depends on\n`libz-sys`. Cargo saves build script stdout under `target/`, so the values end\nup in anything that stores or shares the `target/` directory, such as CI caches.\n\nThis is similar to the [Miri issue](https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/).\n\n## Details\n\nTo decide whether to link against a system zlib, the `libz-sys` build script\ncompiles a small test program with a compiler command from `cc` and logs it\nwith:\n\n```rust\nprintln!(\"running {:?}\", cmd);\n```\n\nOn Unix, `Debug` impl for `std::process::Command` prints every environment\nvariable explicitly set on the command. Before `cc@1.6.0`, its\n`Tool::to_command()` set only a few compiler-specific variables. Starting with\n`cc@1.6.0` (released 2026-10-03), `Tool::to_command()` clears the environment\nand sets every variable explicitly.\n\nCargo parses build script stdout for `cargo:` directives, and stores the full\noutput in the build directory. It also prints it with `-vv`.\n\nThe probe runs for a default `libz-sys` build, including when pkg-config finds\nzlib, unless one of these applies:\n\n* the target is Windows, Android, Haiku or OpenHarmony\n* static linking is requested via the `static` feature or `LIBZ_SYS_STATIC=1`\n* the `zlib-ng` features are enabled without `stock-zlib`\n\n## Mitigations\n\nFixed in `libz-sys@1.1.31`, which no longer logs the probe command.\n\nIf you cannot upgrade, here are some workarounds:\n\n* Build with `LIBZ_SYS_STATIC=1` or the `static` feature, which skips the probe.\n* Pin `cc` to a release before 1.6.0 (`cargo update cc --precise <version>`).\n\nNote that upgrading `libz-sys` does not remove values already written. If an\naffected build already ran with secrets in its environment, clear CI caches and\nstored artifacts containing its\n[target/build directory](https://doc.rust-lang.org/nightly/cargo/reference/build-cache.html#build-cache),\nand consider rotating those secrets.","state":0,"publishedAt":"2026-10-28T12:00:00+00:00","modifiedAt":"2026-10-29T14:15:02.3331414+00:00","affected":[{"ecosystem":"crates.io","name":"libz-sys","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.21"},{"kind":"fixed","version":"1.1.31"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/libz-sys","https://rustsec.org/advisories/RUSTSEC-2026-0418.html","https://github.com/rust-lang/libz-sys/pull/280"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0418","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0418","identifiers":["RUSTSEC-2026-0418","GHSA-8p3x-q3q3-q3v5"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T07:27:10.0308911+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T07:27:10.0308911+00:00","lastSuccessAt":"2026-11-07T07:27:10.1806401+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:10.180641+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-e2c080f02357fa2a3d144a661c51c212b571c4d7ae811251058237d8f5735e04","complete":true,"records":420765,"lastAttemptAt":"2026-11-07T07:27:09.5001885+00:00","lastSuccessAt":"2026-11-07T07:27:09.4258602+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.5001885+00:00","snapshotPublishedAt":"2026-11-07T07:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-27c3440f97484dda858dd714de0d758d","complete":true,"records":13630,"lastAttemptAt":"2026-11-07T07:38:48.4100635+00:00","lastSuccessAt":"2026-11-07T07:38:48.406+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:38:48.406+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T07:27:10.0308911+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T07:27:10.0308911+00:00","lastSuccessAt":"2026-11-07T07:27:10.181531+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:10.1815313+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1262a9fa83024e28a1560dfc0c9cdf3c","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T07:27:10.8526655+00:00","lastSuccessAt":"2026-11-07T06:27:08.533+00:00","error":null,"lastVerifiedAt":"2026-11-07T06:27:08.533+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T07:27:09.8729489+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.8729489+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T07:27:09.6560768+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.6560768+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T07:27:09.9878127+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.9878127+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T07:27:09.7648455+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.7648455+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}