What is GHSA-H7H7-6MX3-R89V?

GHSA-H7H7-6MX3-R89V is a low-severity security vulnerability in fyrox-core (rust), affecting versions >= 0.28.1, < 0.36. It is fixed in 0.36.

Which versions of fyrox-core are affected by GHSA-H7H7-6MX3-R89V?

fyrox-core (rust) versions >= 0.28.1, < 0.36 is affected.

Is there a fix for GHSA-H7H7-6MX3-R89V?

Yes. GHSA-H7H7-6MX3-R89V is fixed in 0.36. Upgrade to this version or later.

Is GHSA-H7H7-6MX3-R89V exploitable, and should I be worried?

Whether GHSA-H7H7-6MX3-R89V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-H7H7-6MX3-R89V is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-H7H7-6MX3-R89V in fyrox-core

Q: Which versions of fyrox-core are affected by GHSA-H7H7-6MX3-R89V?

fyrox-core (rust) versions >= 0.28.1, < 0.36 is affected.

Q: Is there a fix for GHSA-H7H7-6MX3-R89V?

Yes. GHSA-H7H7-6MX3-R89V is fixed in 0.36. Upgrade to this version or later.

Q: Is GHSA-H7H7-6MX3-R89V exploitable, and should I be worried?

Whether GHSA-H7H7-6MX3-R89V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-H7H7-6MX3-R89V is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-H7H7-6MX3-R89V?

Upgrade fyrox-core to 0.36 or later.

Summary

Fyrox has unsound usages of Vec::fromrawparts

The library provides a public safe API transmute_vec_as_bytes, which incorrectly assumes that any generic type T could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as T and cast it to u8 pointer.

In the issue, we develop a PoC to show passing struct type to transmute_vec_as_bytes could lead to undefined behavior with Vec::from_raw_parts.

The developers provide a patch by changing trait of Copy to Pod, which can make sure T should be plain data. This was patched in the latest version of master branch, but still not on the latest release (0.28.1).

Impact

Affected versions

fyrox-core (>= 0.28.1, < 0.36)

Security releases

fyrox-core → 0.36 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade fyrox-core to 0.36 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-H7H7-6MX3-R89V? GHSA-H7H7-6MX3-R89V is a low-severity security vulnerability in fyrox-core (rust), affecting versions >= 0.28.1, < 0.36. It is fixed in 0.36.
Which versions of fyrox-core are affected by GHSA-H7H7-6MX3-R89V? fyrox-core (rust) versions >= 0.28.1, < 0.36 is affected.
Is there a fix for GHSA-H7H7-6MX3-R89V? Yes. GHSA-H7H7-6MX3-R89V is fixed in 0.36. Upgrade to this version or later.
Is GHSA-H7H7-6MX3-R89V exploitable, and should I be worried? Whether GHSA-H7H7-6MX3-R89V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-H7H7-6MX3-R89V is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-H7H7-6MX3-R89V? Upgrade fyrox-core to 0.36 or later.