-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description and GitHub issue explicitly reference the unpack function in instruction.rs as the source of unsoundness. The code shown in the issue demonstrates unsafe pointer casting with &*(&input[1] as *const u8 as *const T) which bypasses Rust's safety checks for alignment and valid bit patterns. The provided PoC examples with bool and u16 demonstrate concrete UB scenarios. The combination of unsafe pointer manipulation in a public API without proper alignment checks or value validation matches the described vulnerability characteristics.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| spl-token-swap | rust | <= 3.0.0 |
RustRustOngoing coverage of React2Shell