GCVE-110-VULN-CARGO-2026-000131

Advisory PublishedCVSS 4.2/10

Vulnetix · Advisory published November 2, 2026

[P-CARGO-BUILD-DOWNLOAD] build.rs downloads a remote resource at build time — matched: let resp = ureq::get(url).call().context("send request")?;

Weaknesses (CWE)

CWE-494Download of Code Without Integrity Check

CVSS 3.1

4.2/10

Medium · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Vendor	Product	Versions	Platforms
cargo	firefly_cli	0.20.2 (affected)	—

advisory

web

1,045 records in the GCVE database · Updated November 6, 2026

No matching records found.

Investigate this vulnerability in the interactive console or download the raw GCVE record.