CVE-2023-38497
HighCVSS 7.9Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. This could allow other local users to modify the source code compiled and executed by the current user.
Risk Assessment
The risk is that a malicious local user could change the source code, potentially leading to the execution of unauthorized or malicious code. This could impact the security of the application and the integrity of the data.
Recommendation
It is recommended to update Cargo to version 0.72.2 or later and Rust to version 1.71.1 or later. Additionally, configure the system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
Other vulnerabilities in Cargo
See all- CVE-2026-5223Medium
Cargo incorrectly handles symbolic links inside crate tarballs downloaded from third-party registries, allowing a malicious crate to overwrite the source code of another crate from the same registry. The vulnerability is medium severity for users of third-party registries; crates.io users are not affected because crates.io forbids uploading crates containing symlinks.
- CVE-2026-5222Medium
Cargo between versions 1.68 and 1.96 incorrectly normalized URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries with arbitrary names in the same domain, an attacker could obtain credentials of other users. Severity is low due to niche requirements.
- CVE-2023-40030Medium
Cargo versions from 1.60.0 to 1.72 did not escape Cargo feature names in reports generated by `cargo build --timings`, potentially allowing for malicious HTML injection. A malicious package included as a dependency could inject JavaScript, creating cross-site scripting risks.
Original NVD description (English source)
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.