Cargo

Rust package manager abuse techniques

4 techniques

Cargo automatically compiles and executes a build.rs file before building any crate that includes one. The build script runs as a native …

Cargo versions before Rust 1.64 accepted two malformed archive patterns from alternate registries. CVE-2022-36113 allowed a crate-supplied …

The `cargo install --git` command clones a git repository and builds its contents locally, including executing any build.rs scripts and …

Rust procedural macros are compiled and executed during compilation when source code invokes one of their derive, attribute, or …