NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🦀 crates.io
Not in CISA KEV

User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflowsGHSA-77h3-w9rx-hj3q

GHSA-77h3-w9rx-hj3q is a remote code execution vulnerability in scratchpad. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Also known asRUSTSEC-2025-0049
Published
Updated
Affected
1 pkg
Patched
None yet
Exploits
None indexed
Exploitation data as of Oct 28, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🦀scratchpad

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the assumption that the crate upholds all safety guarantees.

This becomes problematic because even safe implementations of get and set-written without using any unsafe code-can still result in ill-formed raw pointers. These pointers may later be dereferenced within safe APIs of the crate (e.g., marker::MarkerBack::allocate_slice_copy), potentially leading to arbitrary memory access or heap buffer overflows.

According to the penultimate commit, the crate is in maintenance mode awaiting a cleanup that will reduce the area of unsafe code. Note that the last commits to the repository are from 4 years ago.

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
🦀crates.ioscratchpadall versionsNo fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for scratchpad, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    The records we use list no patched version of scratchpad for GHSA-77h3-w9rx-hj3q. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

  3. Mitigate without a patch

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Frequently Asked Questions

The `get` and `set` methods of the public trait `scratchpad::Tracking` interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the assumption that the crate upholds all safety guarantees. This becomes problematic because even safe implementations of `get` and `set`-written without using any unsafe code-can still result in ill-formed raw pointers. These pointers may later be dereferenced within safe APIs of the crate (e.g.,
O3 Security · Impact-Aware SCA

Is GHSA-77h3-w9rx-hj3q in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works
User-defined implementations of the safe trait…