{"id":"RUSTSEC-2024-0404","aliases":["GHSA-2rxc-gjrp-vjhx"],"title":"Unsoundness in anstream","summary":"Unsoundness in anstream","severity":"none","vendor":"anstream","product":"anstream","ecosystem":"rust","affected":["anstream >= 0.0.0-0, < 0.6.8"],"patched":["anstream 0.6.8"],"published":"2024-09-08","updated":"2026-07-17","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0404","references":[{"url":"https://crates.io/crates/anstream"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0404.html"},{"url":"https://github.com/rust-cli/anstyle/issues/156"}],"tags":["osv","rust"],"ingestedAt":"2026-07-17T19:00:51.860Z","slug":"RUSTSEC-2024-0404","body":"## Overview\n\nWhen given a valid UTF8 string \"ö\\x1b😀\", the function in\ncrates/anstream/src/adapter/strip.rs will be confused. The UTF8\nbytes are \\xc3\\xb6 then \\x1b then \\xf0\\x9f\\x98\\x80.\n\nWhen looping over \"non-printable bytes\" \\x1b\\xf0 will be\nconsidered as some non-printable sequence.\n\nThis will produce a broken str from the incorrectly segmented\nbytes via str::from_utf8_unchecked, and that should never happen.\n\nFull credit goes to [@Ralith](https://github.com/Ralith) who reviewed this code and\nasked [@burakemir](https://github.com/burakemir) to follow up.\n\n## Affected packages\n\n- `anstream >= 0.0.0-0, < 0.6.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `anstream 0.6.8`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}