Is exploration affected by GHSA-99j7-fhr2-xfj4?

crates.io exploration is affected in >= 0.

Is GHSA-99j7-fhr2-xfj4 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

critical

GHSA-99j7-fhr2-xfj4

crates.io · exploration

Summary

`exploration` was removed from crates.io for malicious code

Severity: critical
CWE: CWE-506
Published: 2026-07-10
Updated: 2026-07-10

Advisory details

A method within the exploration crate attempted to download and execute a payload from a remote site.

The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io.

Rustsec to Kirill Boychenko from the Socket Threat Research Team for reporting this crate.

References

Related advisories

RUSTSEC-2026-0155 — medium · crates.io/exploration
GHSA-93qj-5q5v-3c2h — critical · PyPI/pantheon-agents
GHSA-98x5-vq43-vc5p — critical · PyPI/semantic-router
NPM-REDHAT-MIASMA-2026 — critical · npm/@redhat-cloud-services/* (31 packages, 96 versions)
NPM-AXIOS-2026 — critical · npm/axios (1.14.1, 0.30.4)
NPM-SHAI-HULUD-2-2025 — critical · npm/@asyncapi/*, @posthog/*, Zapier, ENS packages (Shai-Hulud 2.0)
NPM-SHAI-HULUD-2025 — critical · npm/@ctrl/tinycolor, ngx-bootstrap, ng2-file-upload (+500 more)
NPM-QIX-CHALK-DEBUG-2025 — critical · npm/chalk, debug, ansi-styles, strip-ansi, color-convert (+13 more)

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.