  In this paper, we analyze the security of programming languages and their
execution environments (compilers and interpreters) with respect to Spectre
attacks. The analysis shows that only 16 out of 42 execution environments have
mitigations against at least one Spectre variant, i.e., 26 have no mitigations
against any Spectre variant. Using our novel tool Speconnector, we develop
Spectre proof-of-concept attacks in 8 programming languages and on code
generated by 11 execution environments that were previously not known to be
affected. Our results highlight some programming languages that are used to
implement security-critical code, but remain entirely unprotected, even three
years after the discovery of Spectre.
