The Rust Security Response Team disclosed that Miri stores all environment variables in the target/ directory, which can persist in GitHub Actions caches and leak secrets to pull request CI runs. The team has implemented a short-term fix limiting preserved variables to CARGO_* (excluding _TOKEN variants) and OUT_DIR, while conducting an ecosystem scan to identify affected repositories.
Background
This vulnerability affects Rust projects using Miri for interpreter testing in CI pipelines that cache the target/ directory. Miri requires certain environment variables to persist between runs, but was storing all environment variables rather than a restricted subset.
- Source
- Lobsters
- Published
- Sep 23, 2026 at 05:38 AM
- Score
- 8.0 / 10