Skip to content
Fencer Vulns
critical 9.4

CVE-2026-30960 json

RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

published 2026-03-08 8 mo ago modified 2026-10-12 27 d ago also GHSA-9c4h-pwmf-m6fj , RUSTSEC-2026-0038 , EUVD-2026-10704

cvss
9.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.

Patch / fix

  • crates.io rssn 0.2.9

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
crates.io rssn
<0.2.9
>=0.1.20, <0.2.9
0.2.9

Affected products

  • Apich-Organization rssn

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-269 Improper Privilege Management
  • CWE-695 Use of Low-Level Functionality
  • CWE-754 Improper Check for Unusual or Exceptional Conditions
  • CWE-15 External Control of System or Configuration Setting
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.