# CVE-2023-40030: cargo: Cargo downloads a Rust project’s dependencies and compiles the project CVE-2023-40030 is fixed in 25 products on 1 platform, first by cargo 1.73.0+dfsg0ubuntu1-0ubuntu1, released August 24, 2023. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2023-40030 - Priority: Routine - CVSS: 6.1 (Medium) - EPSS: 0.0090 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 24, 2023 ## Description Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected. Rust 1.60.0 introduced `cargo build --timings`, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names. As the feature names were included unescaped in the timings report, they could be used to inject Javascript into the page, for example with a feature name like `features = ["<img src='' onerror=alert(0)"]`. If this report were subsequently uploaded to a domain that uses credentials, the injected Javascript could access resources from the website visitor. This issue was fixed in Rust 1.72 by turning the future incompatibility warning into an error. Users should still exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io has server-side checks preventing this attack, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as remote code execution is allowed by design there as well. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | cargo Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [cargo 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-cargo-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | cargo amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | cargo-debuginfo amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | clippy amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | clippy-debuginfo amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | libstd-rust-1.73 Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [libstd-rust-1.73 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libstd-rust-1.73-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rust amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-all Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rust-all 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rust-all-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rust-analysis amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-analyzer amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-analyzer-debuginfo amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-cargo Debian 13.5 (trixie) | 0.76.0-1 | [DEBIAN-CVE-2023-40030](https://patchblox.com/security/data/fix/linux/debian-cve-2023-40030.md) | Aug 24, 2023 | | Linux | rust-cargo Debian 14 | 0.76.0-1 | [DEBIAN-CVE-2023-40030](https://patchblox.com/security/data/fix/linux/debian-cve-2023-40030.md) | Aug 24, 2023 | | Linux | rust-clippy Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rust-clippy 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rust-clippy-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rust-debugger-common amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-debuginfo amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-debugsource amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-doc amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-gdb Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rust-gdb 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rust-gdb-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rust-gdb amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-lldb Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rust-lldb 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rust-lldb-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rust-lldb amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-src Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rust-src 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rust-src-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rust-src amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-std-static amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-std-static-wasm32-unknown-unknown amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rust-std-static-wasm32-wasi amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rustc Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rustc 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rustc-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rustfmt Ubuntu 24.04.5 LTS (noble) | 1.73.0+dfsg0ubuntu1-0ubuntu1 | [rustfmt 1.73.0+dfsg0ubuntu1-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rustfmt-1.73.0-dfsg0ubuntu1-0ubuntu1.md) | Aug 24, 2023 | | Linux | rustfmt amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | | Linux | rustfmt-debuginfo amzn 2023 | 1.68.2-1.amzn2023.0.3 | [ALAS2023-2024-497](https://patchblox.com/security/data/fix/linux/alas2023-2024-497.md) | Jan 19, 2024 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.