The vulnerability lies in the arrayref crate version 0.3.10 for Rust. When a Rust project compiles with this crate, the embedded rogue dependency registers with a command‑and‑control server. This allows the attacker to trigger arbitrary code execution during the build process, representing a CWE-506 weakness, and potentially compromising any binaries produced by the affected project.

Affected products are the arrayref crate maintained by user droundy, specifically version 0.3.10. Projects that depend on this crate without verification are at risk. No other affected vendors or versions are listed.

The flaw has a CVSS score of 9.8, indicating critical severity. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the malicious code activates during compilation when the crate is fetched and compiled. An attacker who can supply or modify a crate dependency can cause the build system to execute arbitrary code, leading to full compromise of the build environment and any resulting software.