# RUSTSEC-2026-0418: libz-sys build script leaks environment variables in the build directory


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026
- **Also known as:** GHSA-8p3x-q3q3-q3v5

## What is RUSTSEC-2026-0418?

RUSTSEC-2026-0418 is a vulnerability in libz-sys, published on 28 Oct 2026. 

### Official description

The build script of `libz-sys` version <= 1.1.30 prints the full environment
of the build, including any secrets it contains, to its stdout when compiled
with `cc@1.6.0` or later on a Unix host. This affects any build that depends on
`libz-sys`. Cargo saves build script stdout under `target/`, so the values end
up in anything that stores or shares the `target/` directory, such as CI caches.

This is similar to the [Miri issue](https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/).

## Details

To decide whether to link against a system zlib, the `libz-sys` build script
compiles a small test program with a compiler command from `cc` and logs it
with:

```rust
println!("running {:?}", cmd);
```

On Unix, `Debug` impl for `std::process::Command` prints every environment
variable explicitly set on the command. Before `cc@1.6.0`, its
`Tool::to_command()` set only a few compiler-specific variables. Starting with
`cc@1.6.0` (released 2026-10-03), `Tool::to_command()` clears the environment
and sets every variable explicitly.

Cargo parses build script stdout for `cargo:` directives, and stores the full
output in the build directory. It also prints it with `-vv`.

The probe runs for a default `libz-sys` build, including when pkg-config finds
zlib, unless one of these applies:

* the target is Windows, Android, Haiku or OpenHarmony
* static linking is requested via the `static` feature or `LIBZ_SYS_STATIC=1`
* the `zlib-ng` features are enabled without `stock-zlib`

## Mitigations

Fixed in `libz-sys@1.1.31`, which no longer logs the probe command.

If you cannot upgrade, here are some workarounds:

* Build with `LIBZ_SYS_STATIC=1` or the `static` feature, which skips the probe.
* Pin `cc` to a release before 1.6.0 (`cargo update cc --precise <version>`).

Note that upgrading `libz-sys` does not remove values already written. If an
affected build already ran with secrets in its environment, clear CI caches and
stored artifacts containing its
[target/build directory](https://doc.rust-lang.org/nightly/cargo/reference/build-cache.html#build-cache),
and consider rotating those secrets.

## Which versions are affected by RUSTSEC-2026-0418?

1 open source package ship an affected version, including libz-sys.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `libz-sys` | crates.io | From 1.0.21 | 1.1.31 |

## How do I fix RUSTSEC-2026-0418?

Upgrade libz-sys to 1.1.31 or later.

## Is RUSTSEC-2026-0418 being exploited?

There is no known exploitation of RUSTSEC-2026-0418 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for RUSTSEC-2026-0418 and fix it if it is affected.

What it is: RUSTSEC-2026-0418 is a vulnerability in libz-sys, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of RUSTSEC-2026-0418 in the wild and no public exploit code.

Affected packages and fixed versions:
- libz-sys (crates.io): affected from 1.0.21; fixed in 1.1.31

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/RUSTSEC-2026-0418/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0418/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/RUSTSEC-2026-0418

---
From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2026-0418/
Summaries are generated and may contain mistakes; the official description above is the record.