CVE-2026-21012 – Rust serde Deserialization of Untrusted Enum (Variant Injection)

Program Code (Rust)

// serde_vuln.rs - Deserializes an enum from user JSON without validation
use serde::{Deserialize, Serialize};
use serde_json;

#[derive(Deserialize, Debug)]
enum AdminAction {
    ReadLogs,
    DeleteUser(String),
    CreateUser(String),
}

#[derive(Deserialize, Debug)]
struct Command {
    action: AdminAction,
}

fn main() {
    let user_input = r#"{"action": {"DeleteUser": "admin"}}"#;
    let cmd: Command = serde_json::from_str(user_input).unwrap();
    println!("Executing: {:?}", cmd.action);
    // Could delete admin if permissions not checked!
}

CVE-2026-21012 – Rust serde Deserialization of Untrusted Enum

Overview

A Rust application using serde deserializes untrusted JSON into an enum without validating that the caller is authorized for the variant. An attacker can inject a different enum variant (e.g., DeleteUser) and trigger unintended actions.

Vulnerability Details

• Type: Insecure Deserialization / Type Confusion
• Impact: Unauthorized action execution.
• Root Cause: The application does not check whether the deserialized enum variant matches the expected limited set for the user’s role.

Exploit Demonstration

Compile and run the Rust program:

cargo add serde serde_json
rustc serde_vuln.rs
./serde_vuln

It executes the DeleteUser variant without authorization.