Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0394

Build environment compiled into the library and readable at runtime

Published Sep 23, 2026 · Updated Oct 26, 2026 · Assigned by RUSTSEC

Description

The build script of `rustpython-vm` 0.3.0 through 0.5.0 writes every
environment variable of the build into `$OUT_DIR/env_vars.rs`. The crate
compiles that file into `_sysconfigdata`'s `build_time_vars`. That module is
always compiled.

A binary built in CI with secrets in the environment carries those secrets
in clear text. Registry tokens, cloud credentials and API keys are the usual
ones. Anyone with the binary can read them with `strings` or from Python.

Version 0.6.0 removes the dump and the include. Users of earlier versions
should upgrade, rebuild, and ship new binaries. Every secret that was in the
environment of a past build whose output left the build machine should be
treated as exposed.

Jacob Finkelman first reported the issue in
[#8802](https://github.com/RustPython/RustPython/issues/8802).
[Bitbison](https://registry.bitbison.io/cargo/rustpython-vm)'s automated
supply chain scanning then detected credential data from the build
environment flowing into artifacts that third-party software ships in the
wild. The leak was confirmed in the published release binaries of at least four
dependants but others have been impacted.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io rustpython-vm >= 0.3.0, < 0.6.0 0.6.0 RUSTSEC-2026-0394

References