rustsec-2026-0418
debian_rustsecThe build script of `libz-sys` version <= 1.1.30 prints the full environment of the build, including any secrets it contains, to its stdout when compiled with `cc@1.6.0` or later on a Unix host. This affects any build that depends on `libz-sys`. Cargo saves build script stdout under `target/`, so the values end up in anything that stores or shares the `target/` directory, such as CI caches. This is similar to the [Miri issue](https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/). ## Details To decide whether to link against a system zlib, the `libz-sys` build script compiles a small test program with a compiler command from `cc` and logs it with: ```rust println!("running {:?}", cmd); ``` On Unix, `Debug` impl for `std::process::Command` prints every environment variable explicitly set on the command. Before `cc@1.6.0`, its `Tool::to_command()` set only a few compiler-specific variables. Starting with `cc@1.6.0` (released 2026-10-03), `Tool::to_command()` clears the environment and sets every variable explicitly. Cargo parses build script stdout for `cargo:` directives, and stores the full output in the build directory. It also prints it with `-vv`. The probe runs for a default `libz-sys` build, including when pkg-config finds zlib, unless one of these applies: * the target is Windows, Android, Haiku or OpenHarmony * static linking is requested via the `static` feature or `LIBZ_SYS_STATIC=1` * the `zlib-ng` features are enabled without `stock-zlib` ## Mitigations Fixed in `libz-sys@1.1.31`, which no longer logs the probe command. If you cannot upgrade, here are some workarounds: * Build with `LIBZ_SYS_STATIC=1` or the `static` feature, which skips the probe. * Pin `cc` to a release before 1.6.0 (`cargo update cc --precise <version>`). Note that upgrading `libz-sys` does not remove values already written. If an affected build already ran with secrets in its environment, clear CI caches and stored artifacts containing its [target/build directory](https://doc.rust-lang.org/nightly/cargo/reference/build-cache.html#build-cache), and consider rotating those secrets.
- Published
- unknown
- Last Modified
- unknown
CVSS details not available.
No product information available.
No references available.
No linked vulnerabilities found.
{
"aliases": [
"GHSA-8p3x-q3q3-q3v5"
],
"categories": [],
"crate": "libz-sys",
"cves": [],
"cvss": 0.0,
"database_specific": {
"severity": ""
},
"date": "2026-10-28",
"deb_packages": [
{
"crate_name": "bat",
"deb_name": "bat",
"version": "0.26.1+ds-2"
},
{
"crate_name": "cargo-c",
"deb_name": "cargo-c",
"version": "0.10.25-1"
},
{
"crate_name": "cargo-outdated",
"deb_name": "cargo-outdated",
"version": "0.19.0-4"
},
{
"crate_name": "debcargo",
"deb_name": "debcargo",
"version": "2.8.4-5"
},
{
"crate_name": "drt-tools",
"deb_name": "drt-tools",
"version": "0.3.5-3+b2"
},
{
"crate_name": "eza",
"deb_name": "eza",
"version": "0.23.5-5"
},
{
"crate_name": "feluda",
"deb_name": "feluda",
"version": "1.17.0-2"
},
{
"crate_name": "git-absorb",
"deb_name": "git-absorb",
"version": "0.9.0-2"
},
{
"crate_name": "git-cinnabar",
"deb_name": "git-cinnabar",
"version": "0.7.3-2+b2"
},
{
"crate_name": "grcov",
"deb_name": "grcov",
"version": "0.10.7-2"
},
{
"crate_name": "libz-sys",
"deb_name": "librust-libz-sys-dev",
"version": "1.1.20-1+b2"
},
{
"crate_name": "lsd",
"deb_name": "lsd",
"version": "1.2.0-5"
},
{
"crate_name": "prr",
"deb_name": "prr",
"version": "0.21.0-2+b2"
},
{
"crate_name": "ripasso-cursive",
"deb_name": "ripasso-cursive",
"version": "0.8.0-1+b7"
},
{
"crate_name": "sequoia-git",
"deb_name": "sequoia-git",
"version": "0.6.0-2+b2"
}
],
"description": "The build script of `libz-sys` version <= 1.1.30 prints the full environment\nof the build, including any secrets it contains, to its stdout when compiled\nwith `cc@1.6.0` or later on a Unix host. This affects any build that depends on\n`libz-sys`. Cargo saves build script stdout under `target/`, so the values end\nup in anything that stores or shares the `target/` directory, such as CI caches.\n\nThis is similar to the [Miri issue](https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/).\n\n## Details\n\nTo decide whether to link against a system zlib, the `libz-sys` build script\ncompiles a small test program with a compiler command from `cc` and logs it\nwith:\n\n```rust\nprintln!(\"running {:?}\", cmd);\n```\n\nOn Unix, `Debug` impl for `std::process::Command` prints every environment\nvariable explicitly set on the command. Before `cc@1.6.0`, its\n`Tool::to_command()` set only a few compiler-specific variables. Starting with\n`cc@1.6.0` (released 2026-10-03), `Tool::to_command()` clears the environment\nand sets every variable explicitly.\n\nCargo parses build script stdout for `cargo:` directives, and stores the full\noutput in the build directory. It also prints it with `-vv`.\n\nThe probe runs for a default `libz-sys` build, including when pkg-config finds\nzlib, unless one of these applies:\n\n* the target is Windows, Android, Haiku or OpenHarmony\n* static linking is requested via the `static` feature or `LIBZ_SYS_STATIC=1`\n* the `zlib-ng` features are enabled without `stock-zlib`\n\n## Mitigations\n\nFixed in `libz-sys@1.1.31`, which no longer logs the probe command.\n\nIf you cannot upgrade, here are some workarounds:\n\n* Build with `LIBZ_SYS_STATIC=1` or the `static` feature, which skips the probe.\n* Pin `cc` to a release before 1.6.0 (`cargo update cc --precise <version>`).\n\nNote that upgrading `libz-sys` does not remove values already written. If an\naffected build already ran with secrets in its environment, clear CI caches and\nstored artifacts containing its\n[target/build directory](https://doc.rust-lang.org/nightly/cargo/reference/build-cache.html#build-cache),\nand consider rotating those secrets.",
"id": "RUSTSEC-2026-0418",
"keywords": [
"build-script",
"environment",
"secrets"
],
"patched_versions": [
">=1.1.31"
],
"source": "debian_rustsec",
"title": "libz-sys build script leaks environment variables in the build directory",
"url": "https://github.com/rust-lang/libz-sys/pull/280"
}