Spotted what might be an issue in native/Cargo.lock around line 1906.
The project pins russh 0.60.2, which contains a critical flaw (CVE‑2026‑46673). The vulnerable CryptoVec implementation allows attacker‑controlled frame lengths to cause unchecked capacity growth and unsafe memory operations, leading to possible memory corruption, denial‑of‑service, or remote code execution. Because russh is used for SSH client/server communication, an attacker controlling either local agent or remote SSH traffic could trigger the bug. The vulnerability is rated HIGH. Updating to russh 0.60.3, where the unsafe paths are fixed, eliminates the risk.
Something like this might fix it:
*** Begin Patch
*** Update File: Cargo.toml
@@
- russh = "0.60.2"
+ russh = "0.60.3"
*** End Patch
After modifying Cargo.toml, run the following command to regenerate Cargo.lock with the patched version:
```
cargo update -p russh
```
This will replace the vulnerable entry in **native/Cargo.lock** (lines 1906‑1986) with the safe version from russh 0.60.3.
For reference: rule CVE-2026-46673. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
native/Cargo.lockaround line 1906.The project pins russh 0.60.2, which contains a critical flaw (CVE‑2026‑46673). The vulnerable CryptoVec implementation allows attacker‑controlled frame lengths to cause unchecked capacity growth and unsafe memory operations, leading to possible memory corruption, denial‑of‑service, or remote code execution. Because russh is used for SSH client/server communication, an attacker controlling either local agent or remote SSH traffic could trigger the bug. The vulnerability is rated HIGH. Updating to russh 0.60.3, where the unsafe paths are fixed, eliminates the risk.
Something like this might fix it:
For reference: rule
CVE-2026-46673. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.