{"action":"Upgrade cargo to 1.72 or later.","affected":[{"fixed":"1.72","introduced":"1.60.0"}],"component":"cargo","cve_ids":["CVE-2023-40030"],"ecosystem":"crates.io","epss":0.00895,"exploited":false,"fixed_versions":["1.72"],"ghsa_id":"GHSA-wrrj-h57r-vx9p","id":"tcs_01M5KF47JA6BWETAEAC0CDDF62","modified_at":"2026-09-10T03:49:57.709943115Z","published_at":"2023-08-24T22:15:51Z","references":["https://osv.dev/vulnerability/GHSA-wrrj-h57r-vx9p","https://github.com/rust-lang/cargo/security/advisories/GHSA-wrrj-h57r-vx9p","https://github.com/rust-lang/cargo/commit/9835622853f08be9a4b58ebe29dcec8f43b64b33","https://github.com/rust-lang/cargo/commit/f975722a0eac934c0722f111f107c4ea2f5c4365","https://github.com/rust-lang/cargo"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-wrrj-h57r-vx9p","url":"https://osv.dev/vulnerability/GHSA-wrrj-h57r-vx9p"}],"summary":"Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports"}