Libz-sys Build Script Leaks Environment Variables
Affects libz-sysSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.1.31
Data as of 29 Oct 2026, 18:35 UTC
What to do
Upgrade libz-sys to 1.1.31.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iolibz-syspkg:cargo/libz-sysOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade libz-sys to version 1.1.31 or later, which removes the logging of the probe command. If upgrading is not possible, build with the static feature or set LIBZ_SYS_STATIC=1 to skip the probe, or pin the cc crate to a version earlier than 1.6.0. Additionally, clear any CI caches and stored build artifacts containing the target directory to remove previously leaked secrets, and consider rotating any exposed secrets.
Description
The libz-sys crate versions 1.0.21 up to but not including 1.1.31 contain a build script vulnerability where the full build environment, including secrets, is printed to stdout during compilation with cc version 1.6.0 or later on Unix hosts. This output is saved by Cargo in the build directory, potentially exposing sensitive environment variables in shared or cached build artifacts. The issue is fixed in libz-sys version 1.1.31.