# CVE-2023-40030: Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports > Malicious dependencies can inject JavaScript into Cargo timing reports, potentially leading to XSS if the report is uploaded to a web server. - **Severity:** Medium 6.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 24 Aug 2023 - **Updated:** 30 Sep 2024 - **Also known as:** AZL-28511, BELL-CVE-2023-40030, DEBIAN-CVE-2023-40030, GHSA-wrrj-h57r-vx9p, SUSE-SU-2023:3722-1, UBUNTU-CVE-2023-40030, openSUSE-SU-2024:13262-1 ## What is CVE-2023-40030? CVE-2023-40030 is a medium-severity cross-site scripting vulnerability in rust-lang cargo, published on 24 Aug 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected. Rust 1.60.0 introduced `cargo build --timings`, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names. As the feature names were included unescaped in the timings report, they could be used to inject Javascript into the page, for example with a feature name like `features = ["