{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amozillasccache/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mozilla:sccache:*:*:*:*:*:*:*:*","cpe:2.3:a:mozilla:sccache:*:*:*:*:*:rust:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2023-1521"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Sccache (\u003c 0.4.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","code-execution","build-security"],"_cs_type":"advisory","_cs_vendors":["Mozilla"],"content_html":"\u003cp\u003eCVE-2023-1521 is a high-severity vulnerability affecting Mozilla Sccache versions earlier than 0.4.0. The vulnerability resides in how the compiler cache utility handles environment variables during the process of invoking a compiler. Specifically, Sccache improperly respects the LD_PRELOAD environment variable when spawning compiler subprocesses. By leveraging this behavior, an attacker with local access to the system can point LD_PRELOAD to a malicious shared library. When Sccache executes a compiler command, it inadvertently loads the attacker-supplied library into the memory space of the compiler process. This mechanism facilitates arbitrary code execution with the privileges of the user running the Sccache utility, potentially leading to privilege escalation if the utility is executed by a high-privilege account or within a continuous integration pipeline.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains local access to a system where Mozilla Sccache (\u0026lt; 0.4.0) is installed.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious shared library (e.g., libpoc.so) containing the payload to be executed.\u003c/li\u003e\n\u003cli\u003eAttacker sets the LD_PRELOAD environment variable to the file path of the malicious shared library.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the sccache command (e.g., 'sccache gcc foo.c -o foo') while the environment variable is active.\u003c/li\u003e\n\u003cli\u003eSccache initiates the compiler subprocess (e.g., gcc).\u003c/li\u003e\n\u003cli\u003eThe dynamic linker loads the malicious shared library into the compiler process due to the LD_PRELOAD directive.\u003c/li\u003e\n\u003cli\u003eThe malicious code within the library executes within the context of the compiler process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the target system. This poses a significant risk to development environments, build servers, and CI/CD pipelines using older versions of Sccache, potentially leading to unauthorized access, exfiltration of credentials or source code, and persistence within the build infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the upgrade of Mozilla Sccache to version 0.4.0 or later to mitigate the vulnerability. Since exploitation requires local access, security teams should focus on monitoring for suspicious compiler invocations and unexpected library loads.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Mozilla Sccache to version 0.4.0 or newer immediately.\u003c/li\u003e\n\u003cli\u003eImplement process monitoring on build servers to detect instances of 'sccache' being invoked with unusual environment variables or unexpected shared object (.so) files being loaded by compilers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T01:30:28Z","date_published":"2026-10-20T01:30:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2023-1521/","summary":"Mozilla Sccache versions prior to 0.4.0 are vulnerable to arbitrary code execution due to improper handling of the LD_PRELOAD environment variable when invoking compilers.","title":"Arbitrary Code Execution in Mozilla Sccache via LD_PRELOAD","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2023-1521/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mozilla:sccache:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}