CVE-2026-77650: Droundy Append-Only-Vec

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Affected products

• Droundy Append-Only-Vec: version 0.1.9 only

Published 2026-08-21. Last modified 2026-09-09.