During Rust compilation of a project that includes the internment crate version 0.8.7, the crate’s rogue dependency registers with a command‑and‑control server enabling arbitrary code execution. This represents a CWE‑506 weakness – a trust boundary violation during build‑time code execution. The flaw permits an attacker to run code with the build environment’s privileges, potentially compromising the developer’s machine and any artifacts produced by the build.

The vulnerability affects the internment crate version 0.8.7 distributed by the droundy vendor. Any Rust project that pulls this specific crate version from a Cargo registry or includes it directly in Cargo.toml is impacted.

The CVSS score of 9.8 classifies this issue as critical, indicating a high potential for confidentiality, integrity, and availability compromise. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be exploitation during the build step, requiring the presence of the vulnerable crate in a developer’s workspace. An attacker who can supply or replace the crate in the dependency resolution process, or who can directly influence the Cargo registry, can trigger the malicious code execution.