eryx 0.12.1

Done dynamic on Linux job 289746 crates.io SBOM Findings (VEX) Compare with 0.12.0

high severity yara:reverse_shell in test code: Reverse shell idioms

low

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	static:yara:reverse_shell static · eryx	tests/socket_bypass_security.rs:254	high severity yara:reverse_shell in test code: Reverse shell idioms
2	static:credential_access static · eryx	tests/vfs_bypass_security.rs:336	medium severity credential_access in test code: \u{a}import os\u{a}\u{a}# Attack: Try to access absolute paths outside the sandbox\u{a}dangerous_paths = [\u{a} '/etc/passwd',\u{a} '/etc/shadow',\u{a} '/proc/self/environ',\u{a} '/proc/1/…
2	static:included_binary static · eryx	src/embedded_stdlib.rs:35	medium severity included_binary in library code: python-stdlib.tar.zst (2995481 bytes)
2	static:shell_command static · eryx	examples/memory_bench.rs:216	medium severity shell_command in binary code (4 places): curl -sL https://github.com/dicej/wasi-wheels/releases/download/v0.0.2/numpy-wasi.tar.gz -o /tmp/numpy-wasi.tar.gz
2	static:yara:persistence_locations static · eryx	tests/vfs_bypass_security.rs:1512	medium severity yara:persistence_locations in test code: Paths and keys used to persist on a developer machine
1	static:build_script static · eryx	build.rs	low severity build_script in build_script code: build.rs

Behavior

Profile

static:credential_access static:included_binary static:shell_command static:yara:persistence_locations static:yara:reverse_shell

Static findings

high yara_match reverse_shell test 1

Reverse shell idioms tests/socket_bypass_security.rs:254

medium shell_command binary 4

curl -sL https://github.com/dicej/wasi-wheels/releases/download/v0.0.2/numpy-wasi.tar.gz -o /tmp/numpy-wasi.tar.gz examples/memory_bench.rs:216 examples/numpy_native.rs:66 examples/numpy_preinit.rs:71 examples/package_loading.rs:39

medium credential_access test 1

\u{a}import os\u{a}\u{a}# Attack: Try to access absolute paths outside the sandbox\u{a}dangerous_paths = [\u{a} '/etc/passwd',\u{a} '/etc/shadow',\u{a} '/proc/self/environ',\u{a} '/proc/1/… tests/vfs_bypass_security.rs:336

medium included_binary library 1

python-stdlib.tar.zst (2995481 bytes) src/embedded_stdlib.rs:35

medium yara_match persistence_locations test 1

Paths and keys used to persist on a developer machine tests/vfs_bypass_security.rs:1512

low network_access library 13

tokio::net::TcpStream src/net.rs:766 src/net.rs:767
tokio::net::lookup_host src/net.rs:1085
tokio::net::TcpStream::connect src/net.rs:1154 src/net.rs:2520 src/net.rs:2551
tokio::net::TcpListener::bind src/net.rs:2518 src/net.rs:2549 src/net.rs:2750 src/net.rs:2865 src/net.rs:2902 src/net.rs:2933 src/net.rs:3012

low network_access test 9

tokio::net::TcpListener::bind tests/guest_runtime_fixes.rs:264 tests/guest_runtime_fixes.rs:298 tests/net_session_correctness.rs:19 tests/secrets_exfiltration_security.rs:37 tests/secrets_integration_test.rs:31 tests/tls_hostname_binding.rs:10 tests/tls_networking.rs:54 tests/tls_networking.rs:813 tests/tls_networking.rs:1163

low build_script build_script 1

build.rs build.rs

info unsafe_code test 17

1 unsafe blocks, functions or impls tests/callback_setup_cache.rs:33 tests/core-sandbox-pool.rs:154 tests/error_handling.rs:43 tests/fuel_limits.rs:30 tests/guest_runtime_fixes.rs:227 tests/pool_capacity.rs:19 tests/pool_release.rs:17 tests/pooling_native_extensions.rs:32 tests/preinit.rs:174 tests/session_abandoned_callback.rs:167 tests/session_and_stream_limits.rs:18 tests/session_limits.rs:23 tests/session_state_persistence.rs:74 tests/vfs_correctness.rs:20 tests/vfs_volumes.rs:18 tests/warm_instances.rs:238
4 unsafe blocks, functions or impls tests/cpu_feature_portability.rs:64

info unsafe_code binary 7

1 unsafe blocks, functions or impls benches/execution.rs:242 examples/jinja2_sandbox.rs:103
2 unsafe blocks, functions or impls examples/memory_bench.rs:350 examples/numpy_preinit.rs:161 examples/precompile.rs:174 examples/session_bench.rs:71
3 unsafe blocks, functions or impls examples/numpy_native.rs:106

info url_literal binary 4

curl -sL https://github.com/dicej/wasi-wheels/releases/download/v0.0.2/numpy-wasi.tar.gz -o /tmp/numpy-wasi.tar.gz examples/memory_bench.rs:216 examples/numpy_native.rs:66 examples/numpy_preinit.rs:71 examples/package_loading.rs:39

info url_literal library 3

:// src/net.rs:1597
GET https://api.example.com:443/x HTTP/1.1\u{d}\u{a} src/net.rs:2975
{"url": "https://example.com"} src/wasm.rs:3637

info unsafe_code library 2

8 unsafe blocks, functions or impls src/sandbox.rs:980
15 unsafe blocks, functions or impls src/wasm.rs:2240

info url_literal test 2

\u{a}try:\u{a} import subprocess\u{a}\u{a} # Try to use curl/wget via subprocess\u{a} try:\u{a} result = subprocess.run(["curl", "http://example.com"], capture_output=True, timeout=5)… tests/socket_bypass_security.rs:295
\u{a}# Attack: urllib/http.client are high-level but use socket internally\u{a}try:\u{a} import urllib.request\u{a}\u{a} # This should use socket internally - does it bypass our shim?\u{a} tr… tests/socket_bypass_security.rs:1073

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 388 ms
VM restore: 55 ms
Payload: 20094 files, 423.2 MiB
Files opened: 652

Processes 1

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	380 ms	25856

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 7
Directories: 12
Size: 56.6 KiB
Compiled units: 0

Nothing outside the build areas.

Output

Standard error

error: rustc 1.98.1 is not supported by the following packages:
  eryx@0.12.1 requires rustc 1.99.1
  eryx@0.12.1 requires rustc 1.99.1
  eryx@0.12.1 requires rustc 1.99.1
Either upgrade rustc or select compatible dependency versions with
`cargo update <name>@<current-ver> --precise <compatible-ver>`
where `<compatible-ver>` is the latest version supporting rustc 1.98.1

Timeline

When	From	To	Event	Worker
2026-10-27 15:28 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-27 15:28 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-27 15:28 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot1
2026-10-27 15:28 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot1
2026-10-27 15:28 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-27 15:28 UTC	Scored	Done	finalized	analyzer-12816