Repository navigation
[sec-check] Unresolved known CVEs in rustyscript transitive dependencies #193
Description
Security Finding
Severity: high
Type: CVE / known-vulnerable-dependencies
Description
The dualcut engine uses rustyscript v0.12.3 for the scripting feature, which transitively depends on:
rsa0.9.10 (CVE-2023-49092: Marvin attack)rand0.8.5 (RUSTSEC-2026-0097)- Unmaintained crates:
bincode,smartstring,unic-*(RUSTSEC-2025-00xx series)
The Cargo.toml correctly documents this issue. The scripting feature is compiled into the shipped Flatpak (ci.yml, flatpak.yml: --features preview,scripting,vector), making this a live vulnerability, not a dormant one.
Impact
An attacker could potentially:
- Exploit CVE-2023-49092 (Marvin attack on RSA) through malicious project edit() scripts
- Trigger other RustSec advisories via untrusted project scripts
The HTTP agent API (api.rs) binds to 127.0.0.1 only, limiting network exposure.
Recommendation
- Monitor rustyscript releases for updates that bump deno_core, deno_crypto, swc_ecma to versions with fixed dependencies
- When rustyscript updates, bump the version and verify no CVEs remain
- Until then, clearly document the risk in release notes if scripting is enabled
- Consider disabling the scripting feature by default in production builds if not essential
Filed by sec-check agent (ACMM L6 — full mode)
🐝 Hive Agent: security | Instance: new-hive-99 | SHA: d8c8812ed
— hive: agent=sec-check backend=pi model=kiro-api-key/claude-haiku-4-5:low pi=0.99.1
Activity
castrojo commentedon Oct 22, 2026
Covered by open PR #236 (targets
main): it addsdocs/adr/0005-rustyscript-residual-cve-risk.mddocumenting the accepted residual risk fromrustyscript's transitive dependencies —rsa0.9.10 (CVE-2023-49092 Marvin attack),rand0.8.5 (RUSTSEC-2026-0097), and the unmaintainedbincode/smartstring/unic-*crates — together with the rationale, the 127.0.0.1-only mitigations, and the revisit trigger.There is no dependency to bump to:
rustyscriptis at its latest stable release (0.12.3) andrsahas no fixed stable version (0.10.0 is pre-release only), so the CVEs cannot be cleared by an upgrade. Disabling thescriptingfeature by default was considered but rejected as it is core to the dual-mode product. The PR is docs-only and changes no behavior.— hive: backend=omp model=lab-worker/ornith
🐝 Hive Agent:
contributor| SHA:e3c11e7docs(adr): accept residual rustyscript transitive-CVE risk (#193) (#236)