Skip to content
Fencer Vulns
high 7.8

CVE-2018-1000622 json

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in…

published 2018-07-09 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1957

cvss
7.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.

Patch / fix

  • rustc Debian 14, Debian 13, Debian 12 1.27.1+dfsg1-1~exp1

debian advisories DEBIAN-CVE-2018-1000622

  • rust-toolset-1.29 devtools 2018 1.29.2-1.el7
  • rust-toolset-1.29-rust devtools 2018 1.29.2-1.el7
  • rust-toolset-1.29-build devtools 2018 1.29.2-1.el7
  • rust-toolset-1.29-cargo devtools 2018 1.29.0-1.el7
  • rust-toolset-1.29-runtime devtools 2018 1.29.2-1.el7
  • rust-toolset-1.29-rust-gdb devtools 2018 1.29.2-1.el7
  • rust-toolset-1.29-rust-src devtools 2018 1.29.2-1.el7
  • rust-toolset-1.29-rust-lldb devtools 2018 1.29.2-1.el7

red hat advisories RHEA-2018:3584

  • rust SLE Module for Development Tools 15 SP1 1.36.0-4.1
  • rust SLE Module for Development Tools 15 1.36.0-3.21.1
  • rust SLE Module for Development Tools 15 1.31.1-3.9.2
  • rust SLE Module for Development Tools 15 1.24.1-3.6.1

suse advisories SUSE-SU-2019:2755-1SUSE-SU-2019:2439-1SUSE-RU-2019:0386-1SUSE-SU-2018:3357-1

  • rust1.53 openSUSE Tumbleweed 1.53.0-2.5
  • rust openSUSE Leap 15.1 1.36.0-lp151.5.8.1
  • rust-cbindgen openSUSE Leap 15.1 0.8.7-lp151.5.2
  • rust openSUSE Leap 15.1 1.36.0-lp151.5.4.2
  • rust openSUSE Leap 15.1 1.36.0-lp151.5.4.1
  • rust-cbindgen openSUSE Leap 15.1 0.8.7-lp151.2.2

opensuse advisories openSUSE-SU-2024:11360-1openSUSE-SU-2019:2294-1openSUSE-SU-2019:2244-1openSUSE-SU-2019:2203-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000622 updated cvss 5.3

rust: rustdoc loads plugins from world writable directory allowing for arbitrary code execution

  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rust-toolset-1.29 1.29.2-1.el7, rust-toolset-1.29-rust 1.29.2-1.el7, rust-toolset-1.29-build 1.29.2-1.el7, rust-toolset-1.29-cargo 1.29.0-1.el7, rust-toolset-1.29-runtime 1.29.2-1.el7, rust-toolset-1.29-rust-gdb 1.29.2-1.el7, +8 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rust-toolset-1.29 1.29.2-1.el7, rust-toolset-1.29-rust 1.29.2-1.el7, rust-toolset-1.29-build 1.29.2-1.el7, rust-toolset-1.29-cargo 1.29.0-1.el7, rust-toolset-1.29-runtime 1.29.2-1.el7, rust-toolset-1.29-rust-gdb 1.29.2-1.el7, +8 more
    fixed: vendor fix RHEA-2018:3584

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.82% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.