CVE-2026-77649: Droundy Internment

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Affected products

• Droundy Internment: version 0.8.7 only

Published 2026-08-21. Last modified 2026-09-09.