CVE-2026-5222
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Cargo between versions 1.68 and 1.96 incorrectly normalized URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries with arbitrary names in the same domain, an attacker could obtain credentials of other users. Severity is low due to niche requirements.
Risk Assessment
Under specific conditions, an attacker can steal credentials of other registry users, potentially leading to unauthorized access to packages and source code.
Recommendation
Upgrade Cargo to version 1.97 or later, which fixes the URL normalization issue.
Other vulnerabilities in Cargo
See all- CVE-2026-5223Medium
Cargo incorrectly handles symbolic links inside crate tarballs downloaded from third-party registries, allowing a malicious crate to overwrite the source code of another crate from the same registry. The vulnerability is medium severity for users of third-party registries; crates.io users are not affected because crates.io forbids uploading crates containing symlinks.
- CVE-2023-40030Medium
Cargo versions from 1.60.0 to 1.72 did not escape Cargo feature names in reports generated by `cargo build --timings`, potentially allowing for malicious HTML injection. A malicious package included as a dependency could inject JavaScript, creating cross-site scripting risks.
- CVE-2023-38497High
Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. This could allow other local users to modify the source code compiled and executed by the current user.
Original NVD description (English source)
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.