RUSTSEC-2026-0281
Vulnerability from osv_rustsec
A new version of the greentic-setup crate was published with a variant
of the PolinRider malware included that would fire when a project
depending on greentic-setup was opened in Visual Studio Code.
One malicious version was published on 2026-09-06, approximately 27 hours
before removal. This crate is depended on by four other crates in the
Greentic ecosystem, namely greentic-start, greentic-start-dev,
greentic-operator, and greentic-operator-dev. We have no evidence that this
crate version was downloaded by any actual users, but Greentic users should
check their systems nonetheless.
Thanks to the Research Team at Nextron Systems GmbH for the report.
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"categories": [
"malicious"
],
"cvss": null,
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "greentic-setup",
"purl": "pkg:cargo/greentic-setup"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.1-dev.34027618345"
},
{
"fixed": "1.3.1-dev.34027618345.0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "A new version of the `greentic-setup` crate was published with a variant\nof the PolinRider malware included that would fire when a project\ndepending on `greentic-setup` was opened in Visual Studio Code.\n\nOne malicious version was published on 2026-09-06, approximately 27 hours\nbefore removal. This crate is depended on by four other crates in the\nGreentic ecosystem, namely `greentic-start`, `greentic-start-dev`,\n`greentic-operator`, and `greentic-operator-dev`. We have no evidence that this\ncrate version was downloaded by any actual users, but Greentic users should\ncheck their systems nonetheless.\n\nThanks to the Research Team at Nextron Systems GmbH for the report.",
"id": "RUSTSEC-2026-0281",
"modified": "2026-09-07T18:19:30Z",
"published": "2026-09-07T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/greentic-setup"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0281.html"
}
],
"related": [],
"severity": [],
"summary": "`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.