rustpython-vm 0.6.0

secrets-exposureCovers 0.3.0, 0.3.1, 0.4.0 and 0.5.0Reviewed by BitbisonUpdated 2026-10-19

The build script copies every environment variable of the build into the library. CI tokens and cloud keys present at build time end up inside the binary. Python code can read them with sysconfig.get_config_vars(). Fixed in 0.6.0.

What the code does

The build script of rustpython-vm 0.3.0 through 0.5.0 writes every environment variable of the build into $OUT_DIR/env_vars.rs:

let mut env_path = PathBuf::from(env::var_os("OUT_DIR").unwrap());
env_path.push("env_vars.rs");
let mut f = std::fs::File::create(env_path).unwrap();
write!(f, "sysvars! {{ {} }}",
    std::env::vars_os().format_with(", ", |(k, v), f| f(&format_args!("{k:?} => {v:?}"))))

The library compiles that file in. In 0.5.0 the include is at src/stdlib/_sysconfigdata.rs, line 72, inside build_time_vars. In 0.3.0, 0.3.1 and 0.4.0 it is at src/stdlib/sysconfigdata.rs, line 22. The module is always compiled. No feature turns it off.

Every variable set when cargo ran the build script becomes a string in librustpython_vm.rlib. It is also in every program that links the library. Python code running on that interpreter can read them with sysconfig.get_config_vars().

What this means

A build environment often holds secrets. CARGO_REGISTRY_TOKEN, GITHUB_TOKEN, AWS keys, API keys, database URLs. When such a program is built in CI and shipped, those secrets ship inside it in clear text. Anyone with the binary can read them with strings. Any Python code the program runs can read them through sysconfig.

We confirmed it in our own build of outl-exec 0.13.0-beta.256, which builds rustpython-vm 0.5.0. Our sandbox plants marked fake credentials in the build environment. After the build, the marker was in out/env_vars.rs, in librustpython_vm.rlib, and in every test binary that linked it.

We also checked public release binaries of four projects that depend on these versions. Every one of them contains the full environment of the GitHub Actions job that built it.

Conclusion

This is not malicious. The dump existed to give sysconfig the build configuration. The authors removed it as soon as it was reported (issue #8802, PR #8813, merged 2026-09-24). Version 0.6.0, published 2026-10-02, no longer writes or includes the file. We checked its source.

The problem stands for every release before 0.6.0 that anyone still builds. There is no RustSec advisory. cargo audit does not warn about it. These are 0.x versions. A ^0.5 or ^0.4 requirement never upgrades to 0.6.0 on its own.

What to do

If you build a program on rustpython-vm 0.5.0 or earlier:

1. Upgrade to 0.6.0 or later.
2. Rebuild and ship new binaries.
3. If a binary built in CI left the build machine, treat every secret that was in that job's environment as exposed. Rotate it.
4. Until you upgrade, build with a clean environment. env -i with only what the build needs.

Versions

• 0.1.0, 0.1.1, 0.1.2 (yanked): no dump.
• 0.3.0, 0.3.1, 0.4.0, 0.5.0: dump written and compiled in.
• 0.6.0: fixed.

Links

• rustpython-vm on crates.io
• RustPython issue #8802
• RustPython PR #8813, the fix
• rustpython-vm 0.6.0, the first release without the dump