# Does CVE-2023-40030 has NO impact on Rust 1.72 and higher? **URL:** \ **Category:** community\ **Created:** [January 21, 2025, 9:17am UTC](https://users.rust-lang.org/t/does-cve-2023-40030-has-no-impact-on-rust-1-72-and-higher/124396 "2025-01-21T09:17:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Prabhangshu](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@Prabhangshu](https://users.rust-lang.org/u/Prabhangshu)\ **Post date:** [January 21, 2025, 9:17am UTC](https://users.rust-lang.org/t/does-cve-2023-40030-has-no-impact-on-rust-1-72-and-higher/124396/1 "2025-01-21T09:17:39Z")
Hey Everyone, I came across CVE-2023-40030 [NVD - cve-2023-40030](https://nvd.nist.gov/vuln/detail/cve-2023-40030) , so as described in NVD and few other sites, can we conclude that Rust1.72 and higher are not impacted? ---
**Author:** ![jofas](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/jofas/32/30690_2.png) [@jofas](https://users.rust-lang.org/u/jofas)\ **Post date:** [January 21, 2025, 9:26am UTC](https://users.rust-lang.org/t/does-cve-2023-40030-has-no-impact-on-rust-1-72-and-higher/124396/2 "2025-01-21T09:26:21Z")
> [@Prabhangshu](#): > > can we conclude that Rust1.72 and higher are not impacted? Yes. You can find more about the vulnerability here: > **[Malicious dependencies can inject arbitrary JavaScript into cargo-generated...](https://github.com/rust-lang/cargo/security/advisories/GHSA-wrrj-h57r-vx9p)** > > The Rust Security Response WG was notified that Cargo did not escape Cargo feature names when including them in the report generated by \`cargo build --timings\`. A malicious package included as a de... and the fix here: > > > This converts the feature name validation check from a warning to an error. This… was added in #8814 in Rust 1.49 released in 2020-12-31 (about 2.5 years ago) with a warning that it will become a hard error in the future. > > These extended characters aren't allowed on crates.io, so this should only impact users of other registries, or people who don't publish to a registry. The warning message requested anyone impacted by it to let us know. We got one report, and added support for . as result. Since there weren't any other reports, I think it should be pretty safe to move forward. > > The diff here is a little large because it removes the pass-through of \`config\` since it isn't needed anymore. > Additionally, the tests were restructured since testing every edge case in an integration test has a lot of overhead. Instead, there is now a unit test which runs much faster, with the integration test just verifying that it fires and checks the two forms of error messages. > > Closes #8813 ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/system/32/51372_2.png) [@system](https://users.rust-lang.org/u/system)\ **Post date:** [April 21, 2025, 9:26am UTC](https://users.rust-lang.org/t/does-cve-2023-40030-has-no-impact-on-rust-1-72-and-higher/124396/3 "2025-04-21T09:26:57Z")
Closed on April 21, 2025, 9:26am UTC This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.