RUSTSEC-2026-0281 `greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
A malicious version of the greentic-setup Rust crate was published, allowing code execution when projects are opened in VS Code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is RUSTSEC-2026-0281?
RUSTSEC-2026-0281 is a vulnerability in greentic-setup, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A new version of the greentic-setup crate was published with a variant
of the PolinRider malware included that would fire when a project
depending on greentic-setup was opened in Visual Studio Code.
One malicious version was published on 2026-09-06, approximately 27 hours
before removal. This crate is depended on by four other crates in the
Greentic ecosystem, namely greentic-start, greentic-start-dev,
greentic-operator, and greentic-operator-dev. We have no evidence that this
crate version was downloaded by any actual users, but Greentic users should
check their systems nonetheless.
Thanks to the Research Team at Nextron Systems GmbH for the report.
Which versions are affected by RUSTSEC-2026-0281?
1 open source package ship an affected version, including greentic-setup.
| Package | Affected | Fixed in |
|---|---|---|
greentic-setup crates.io | From 1.3.1-dev.34027618345 | 1.3.1-dev.34027618345.0 |
How do I fix RUSTSEC-2026-0281?
Upgrade greentic-setup to 1.3.1-dev.34027618345.0 or later.
Is RUSTSEC-2026-0281 being exploited?
There is no known exploitation of RUSTSEC-2026-0281 in the wild and no public exploit code.