RUSTSEC-2026-0175 `onering` 1.4.1 was removed from crates.io for malicious code
A malicious version of the onering Rust crate attempted to exfiltrate project metadata and code, requiring developers to avoid the compromised release.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0175?
RUSTSEC-2026-0175 is a vulnerability in onering, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A new version of the onering crate was published with code that attempted to
exfiltrate both metadata and code from the project it was included within.
One malicious version was published on 2026-06-10, approximately six hours before removal. This crate has no dependencies on crates.io, and there is no evidence of actual usage of the compromised version.
Thanks to Charlie Eriksen for the report.
Which versions are affected by RUSTSEC-2026-0175?
1 open source package ship an affected version, including onering.
| Package | Affected | Fixed in |
|---|---|---|
onering crates.io | From 1.4.1 | 1.4.2-0 |
How do I fix RUSTSEC-2026-0175?
Upgrade onering to 1.4.2-0 or later.
Is RUSTSEC-2026-0175 being exploited?
There is no known exploitation of RUSTSEC-2026-0175 in the wild and no public exploit code.