# RUSTSEC-2025-0165: i_tree allowed out-of-bounds access through safe public node accessors

> Attackers can trigger undefined behavior and potential code execution by passing out-of-bounds indices to safe public node accessors in the i_tree library.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Jul 2025

## What is RUSTSEC-2025-0165?

RUSTSEC-2025-0165 is a memory corruption vulnerability in i_tree, published on 4 Jul 2025. 

### Official description

Affected versions of `i_tree` exposed safe public `Tree::node` and `Tree::mut_node` methods in the public `tree` module. These methods accepted an arbitrary `u32` index and passed it directly to `Vec::get_unchecked` / `get_unchecked_mut` on the internal node buffer, without validating that the index was in bounds.

Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any `unsafe` code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.

Starting with `0.10.0` the crate was restructured and these accessors are no longer reachable from outside the crate.

## Which versions are affected by RUSTSEC-2025-0165?

1 open source package ship an affected version, including i_tree.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `i_tree` | crates.io | From 0.0.0-0 | 0.10.0 |

## How do I fix RUSTSEC-2025-0165?

Upgrade i_tree to 0.10.0 or later.

## Is RUSTSEC-2025-0165 being exploited?

There is no known exploitation of RUSTSEC-2025-0165 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for RUSTSEC-2025-0165 and fix it if it is affected.

What it is: RUSTSEC-2025-0165 is a memory corruption vulnerability in i_tree, published on 4 Jul 2025. 
Exploitation: There is no known exploitation of RUSTSEC-2025-0165 in the wild and no public exploit code.

Affected packages and fixed versions:
- i_tree (crates.io): affected from 0.0.0-0; fixed in 0.10.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/RUSTSEC-2025-0165/ (Markdown: https://insights.sbomify.com/RUSTSEC-2025-0165/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/RUSTSEC-2025-0165

---
From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2025-0165/
Summaries are generated and may contain mistakes; the official description above is the record.