#8802 and #8813 fixed build.rs dumping the whole build environment into _sysconfigdata. The fix PR describes the effect: any secret in the build environment shipped inside the resulting binary, readable with strings or sysconfig.get_config_vars(). Versions 0.3.0 through 0.5.0 are affected. 0.6.0 is fixed.

No advisory exists for it yet. Dependants pinned to ^0.5, ^0.4 or ^0.3 never pick up 0.6.0 on their own and get no warning. We confirmed the leak in published release binaries of four dependants. Each one carries the GitHub Actions environment of the job that built it. Their maintainers have been told.

We opened a RustSec advisory so cargo audit and cargo deny warn those dependants: rustsec/advisory-db#3405. RustSec asks that the maintainers confirm an advisory is appropriate. Are you fine with it?

A GitHub Security Advisory on this repository would also help. It gets a CVE assigned and reaches Dependabot users. If you publish one, we will add its id to the RustSec entry.

Reference: https://registry.bitbison.io/cargo/rustpython-vm