products / rust

Rust

Rust is the systems language from the Rust Project, used for CLIs, services, and embedded tooling. NVD tracks the compiler and standard library under cpe:2.3:a:rust-lang:rust. High-severity CVEs in that namespace are fewer than for older runtimes, and most recent critical issues target Windows process spawning rather than memory unsafety in safe Rust.

api usage

Querying Rust

product slugrust

version format1.70.0, 1.82.0, 1.77.2

bash

curl "https://api.attestd.io/v1/check?product=rust&version=1.70.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Rust 1.70.0 is affected by CVE-2024-24576. On Windows, std::process::Command fails to escape .bat and .cmd arguments, which allows arbitrary shell command execution. The response reflects that command-injection risk with a patch available at 1.77.2.

json

{
  "product": "rust",
  "version": "1.70.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-40030",
    "CVE-2024-24576",
    "CVE-2024-3566",
    "CVE-2024-43402",
    "CVE-2026-15957",
    "CVE-2026-62203",
    "CVE-2026-71282"
  ],
  "cves": null,
  "max_epss": 0.20342,
  "last_updated": "2026-08-05T21:12:34.003647Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

safe version

Rust 1.82.0 is past the 1.81.0 fix for CVE-2024-43402, the incomplete follow-up to CVE-2024-24576, and has no known high-severity rust-lang:rust CVEs in the tracked ranges.

bash

curl "https://api.attestd.io/v1/check?product=rust&version=1.82.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Public high-severity rust-lang:rust CVEs are fewer than for other runtimes. The highest scores in recent years come from Windows batch argument escaping bugs in the standard library, plus an older TOCTOU issue in directory removal.

CVE	Description	Affects	CVSS
`CVE-2024-24576`	On Windows, std::process::Command fails to escape .bat/.cmd arguments and allows arbitrary shell command execution.	<1.77.2	10.0
`CVE-2024-43402`	Incomplete fix for CVE-2024-24576 lets trailing whitespace or periods in batch names bypass escaping.	<1.81.0	8.8
`CVE-2022-21658`	TOCTOU in std::fs::remove_dir_all lets attackers delete unintended files.	≤1.58.0	6.3

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Single CPE namespace

NVD publishes Rust compiler and standard library CVEs under one CPE product identifier:

cpe:2.3:a:rust-lang:rustCompiler and stdlib CVEs

Attestd matches queries against this namespace and synthesizes risk across the applicable version ranges for a single product slug.

All products Go Python Quickstart