@kpcyrd @tekkie And the vulnerability is really narrow: To be affected, you need to download a malicious crate. Note that as soon as you compile such a malicious crate, it can do harm much more directly because compiling rust code inherently allows for arbitrary code execution through build.rs and proc macros.