CVE-2026-30960 Details
Description
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.
A vulnerability in the rssn library's Just-In-Time (JIT) compilation engine allows for arbitrary code execution. This issue arises from improper input validation and external control of code generation, enabling attackers to inject malicious parameters or instruction sequences through the C Foreign Function Interface (CFFI). The vulnerability is present in versions of rssn prior to 0.2.8 and can be exploited in environments where the library operates with elevated privileges or in high-performance computing contexts.
Users can upgrade to rssn version 0.2.9 or later to address this vulnerability. If an immediate upgrade is not possible, consider implementing strict sandboxing, ensuring processes do not have administrative privileges, applying input filtering, or disabling JIT execution if the library supports an interpreter-only mode.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 10, 2026CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Apich-Organization/rssn/releases/tag/v0.2.9 | [email protected] | Release NotesVendor |
| https://github.com/Apich-Organization/rssn/security/advisories/GHSA-9c4h-pwmf-m6fj | [email protected] | AdvisoryRemedyVendor |
| https://rustsec.org/advisories/RUSTSEC-2026-0038.html | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-695 | Use of Low-Level Functionality | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apich rssn | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |