The append‑only‑vec crate version 0.1.9 from droundy contains a rogue dependency that registers with a command‑and‑control server and can execute arbitrary code during the compilation of a Rust project. When the crate is built, the malicious code runs as part of the build process, enabling an attacker to inject malware or compromise the build environment. This flaw is a classic example of compiled code injection (CWE‑506) and results in full program compromise without requiring further user interactions. The high CVSS score of 9.8 reflects the severity of executing code during build time, which can affect any system that compiles the vulnerable crate.

The vulnerability impacts projects that depend on droundy’s append‑only‑vec crate, specifically version 0.1.9. Any Rust development environment, continuous integration pipeline, or build server that pulls this crate for compilation is at risk. The attack does not require a network connection to the target at runtime; the malicious payload is delivered at compile time via an external dependency.

With a CVSS score of 9.8 the vulnerability is classified as critical. Although the EPSS score is not available, the lack of a known exploitation indicator does not mitigate the inherent risk of compromised build artifacts. The attack vector is inferred to be supply‑chain—an attacker who can influence the dependency chain or intercept the build can trigger code execution. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and the nature of the flaw mean that any use of the affected crate should be considered a security risk until it is patched or replaced.