{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.0.0-0"}],"component":"metacall","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":[],"id":"tcs_01M5KFBF8QV6CPKN240YY8RSAZ","modified_at":"2026-05-13T15:00:15.670790Z","published_at":"2026-05-02T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0139","https://crates.io/crates/metacall","https://rustsec.org/advisories/RUSTSEC-2026-0139.html","https://github.com/metacall/core/issues/618"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0139","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0139"}],"summary":"Null-pointer dereference and double-free via safe APIs"}