CVE-2026-77651: Droundy Arrayref

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Affected products

• Droundy Arrayref: version 0.3.10 only

Published 2026-08-21. Last modified 2026-09-09.