CycloneDX Rust Cargo

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ €10,000 │ €11,000 High │ €5,000 │ €6,000 Medium │ €3,000 │ €3,750 Low │ €500 │ €625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Latest advisories Loading the feed Overview CycloneDX Rust Cargo is the Apache-2.0 Cargo plugin that walks a Rust project's dependency graph and emits a CycloneDX software bill of materials from it. That makes it a small tool with a disproportionate blast radius: the document it produces is consumed downstream as a supply-chain attestation, fed into vulnerability scanners, procurement checks and compliance pipelines, and it usually runs unattended in CI against whatever manifests and lockfiles a repository happens to contain. A defect that lets a crafted dependency graph execute code inside the build, or that quietly makes the generated SBOM omit a component that is genuinely present, undermines the exact guarantee the tool exists to provide. It is funded through the German Sovereign Tech Agency's open-source bug bounty push on YesWeHack, paying up to €10,000 for a Critical, €5,000 for a High, €3,000 for a Medium and €500 for a Low. One caveat before you commit time: the live program page sits behind a YesWeHack sign-in, so confirm the current bands there and check that the program is still accepting reports. sorona.xyz adds 1.25× on top of whatever the program awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program's namesake asset, the Apache-2.0 CycloneDX/cyclonedx-rust-cargo project, published on YesWeHack under the Sovereign Tech Agency's open-source funding. The cargo-cyclonedx subcommand as it ships: argument and configuration parsing, the Cargo metadata it ingests, the dependency-graph walk it performs and the document it serialises Every input the tool reads but did not write: Cargo.toml manifests, Cargo.lock lockfiles, workspace layouts and the package metadata of each transitive dependency, all of it controlled by whoever wrote the repository being scanned Correctness of the emitted bill of materials: component identity, versions, package URLs, hashes, licence fields and dependency relationships, because downstream scanners and compliance checks read that document as ground truth Both serialisation targets and every CycloneDX specification version the tool can emit, where an escaping or injection defect changes what a consumer parses out of the result Output handling: the paths the tool writes to and the files it replaces when it is pointed at a project directory nobody has vetted The context the tool is built for, running unattended in CI over untrusted code with no operator watching the run Out of scope The CycloneDX specification itself, and the sibling CycloneDX implementations for other ecosystems, which are separate projects with their own repositories Defects that actually live in Cargo, rustc or crates.io rather than in the plugin, which belong upstream with those projects Findings you cannot tie back to the Apache-2.0 cyclonedx-rust-cargo code this program is scoped to Unpayable without KYC: the platform verifies identity before releasing money, so the account you file under has to be verifiable in your own name Most-valued findings Code execution reached while processing an attacker-controlled manifest, lockfile or dependency graph. The tool runs unattended in CI over repositories nobody has vetted, so this is the class most likely to be graded Critical and to reach the €10,000 top band. SBOM falsification: making the generated document omit or misreport a component that is genuinely in the dependency graph, since every downstream scanner and compliance check treats that document as ground truth and a silent omission is a vulnerability that never gets flagged Path traversal or arbitrary file write during generation or output, where a crafted project directs the tool to read or overwrite something outside the workspace it was pointed at Unbounded resource consumption on a hostile dependency graph, which on an unattended CI runner is a denial of service against the build pipeline rather than a local annoyance Anything demonstrated on a default invocation against a normal project, rather than on a flag combination the reporter had to construct: the plugin's whole value is that it is run automatically with no arguments Low-severity work is still worth writing up here. All four bands carry a published figure, so a well-evidenced Low pays €500 instead of being filed and forgotten Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. KYC is required before a payout is released, so the account you file under has to be verifiable in your own name YesWeHack applies a report submission cost on some programs, so check what this one charges after you sign in rather than assuming that filing is free The live program page sits behind a YesWeHack sign-in, so confirm the current reward bands there before you size your effort against the figures on this page The Sovereign Tech Agency's funded set of open-source programs has changed since it was announced, so sign in and confirm this program is still accepting reports before you start work File with YesWeHack before the finding goes anywhere else, and read the program's own terms on publication once you are signed in Disclosure Coordinated through YesWeHack. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability