9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30960

CVE-2026-30960: RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30960

CVE-2026-30960:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rssn	rust	< 0.2.9	0.2.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Arbitrary Code Execution in the JIT engine's C-FFI interface. The analysis of the patch commit dea11c594f39db503e84a51f1e3c2a93f8baa8eb reveals that the core of the vulnerability was the lack of sandboxing for JIT-compiled code. The proof-of-concept files (poc1.py, poc2.py, poc3.py) included in the patch confirm that the exploit involves crafting a malicious JSON payload with JIT instructions and using the C-FFI functions to compile and execute it.

The primary vulnerable functions identified are:

rssn_jit_execute: Located in src/ffi_apis/jit_ffi/handle.rs, this function was modified to enforce a sandbox context during execution. The original function directly executed a raw function pointer, which is the sink of the vulnerability.
rssn_jit_compile_json: Located in src/ffi_apis/jit_ffi/json.rs, this function is the entry point for the malicious instructions. The patch introduces a new function, rssn_jit_configure_sandbox_json, to configure sandbox settings like allowed memory regions and call targets, which were previously absent, allowing the compilation of unsafe instructions.

The root cause is improper control of code generation (CWE-94) and improper input validation (CWE-20) in the C-FFI layer, allowing an attacker to execute arbitrary code at the privilege level of the process using the library.

Vulnerable functions

rssn_jit_execute

src/ffi_apis/jit_ffi/handle.rs

The original implementation of `rssn_jit_execute` executed raw function pointers returned by the JIT compiler without any sandboxing. This allowed an attacker who could control the input to the JIT compiler to execute arbitrary code with the privileges of the host process.

rssn_jit_compile_json

src/ffi_apis/jit_ffi/json.rs

This function is the entry point for the malicious payload. It deserializes a JSON string containing a sequence of JIT instructions and compiles them into executable code. The vulnerability is that it would compile dangerous instruction sequences (like arbitrary memory loads as shown in the PoC) without proper validation or sandboxing, leading to arbitrary code execution when the compiled code is run via `rssn_jit_execute`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.