{"id":"GHSA-2rxc-gjrp-vjhx","aliases":["RUSTSEC-2024-0404"],"url":"https://o3.security/vulnerability/GHSA-2rxc-gjrp-vjhx","summary":"Unsoundness in anstream","details":"When given a valid UTF8 string \"ö\\x1b😀\", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \\xc3\\xb6 then \\x1b then \\xf0\\x9f\\x98\\x80.\n\nWhen looping over \"non-printable bytes\" \\x1b\\xf0 will be considered as some non-printable sequence.\n\nThis will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.\n\nFull credit goes to @Ralith who reviewed this code and asked @burakemir to follow up.","published":"2024-12-04T18:31:31Z","modified":"2026-09-10T03:50:21.162155425Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"anstream","fixedVersion":"0.6.8"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/rust-cli/anstyle/issues/156"},{"type":"PACKAGE","url":"https://github.com/rust-cli/anstyle"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0404.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:21.162155425Z"}}