PT-2026-24192 · Rssn · Rssn

Panayang

·

Published

2026-03-08

·

Updated

2026-03-16

·

CVE-2026-30960

CVSS v4.0

9.4

Critical

VectorAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions rssn versions prior to 0.2.9
Description The rssn scientific computing library for Rust has an issue in its JIT (Just-In-Time) compilation engine, which is exposed through the CFFI (Foreign Function Interface). Insufficient input validation and external control of code generation allow an attacker to supply malicious parameters or instruction sequences via the CFFI layer. This can lead to Arbitrary Code Execution (ACE) at the privilege level of the host process. The library is often used in high-performance computing contexts and multi-language environments, potentially impacting developers, cloud service providers, and users processing untrusted data.
Recommendations Versions prior to 0.2.9 should be upgraded to version 0.2.9 or later. As a temporary workaround, consider running the library within a restricted sandbox, such as WebAssembly, Docker with a non-root user, or seccomp profiles, to limit system call access. Ensure the process calling the library does not have administrative or root privileges. Implement an application-level validation layer to sanitize any data passed to the CFFI interfaces, if possible. If your workload allows, use the interpreter-only mode to bypass the JIT engine entirely.

Exploit

Fix

RCE

Code Injection

Improper Privilege Management

Improper Check for Exceptional Conditions

Related Identifiers

CVE-2026-30960
GHSA-9C4H-PWMF-M6FJ
RUSTSEC-2026-0038

Affected Products

Rssn