Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. zoo-kcl
  4. ›
  5. GHSA-mc9m-6fm9-pghc

GHSA-mc9m-6fm9-pghc: Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

August 20, 2026

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box>.

References

  • github.com/KittyCAD/modeling-app/security/advisories/GHSA-mc9m-6fm9-pghc
  • github.com/advisories/GHSA-mc9m-6fm9-pghc

Code Behaviors & Features

Detect and mitigate GHSA-mc9m-6fm9-pghc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.3.153

Fixed versions

  • 0.3.153

Solution

Upgrade to version 0.3.153 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-416: Use After Free

Source file

pypi/zoo-kcl/GHSA-mc9m-6fm9-pghc.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:13 +0000.