CVE-2026-5223
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Cargo incorrectly handles symbolic links inside crate tarballs downloaded from third-party registries, allowing a malicious crate to overwrite the source code of another crate from the same registry. The vulnerability is medium severity for users of third-party registries; crates.io users are not affected because crates.io forbids uploading crates containing symlinks.
Risk Assessment
Organizations using third-party registries may suffer from malicious code injection into dependencies, potentially leading to application compromise.
Recommendation
Avoid using third-party registries that do not forbid symbolic links, or implement additional integrity verification mechanisms for crates.
Other vulnerabilities in Cargo
See all- CVE-2026-5222Medium
Cargo between versions 1.68 and 1.96 incorrectly normalized URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries with arbitrary names in the same domain, an attacker could obtain credentials of other users. Severity is low due to niche requirements.
- CVE-2023-40030Medium
Cargo versions from 1.60.0 to 1.72 did not escape Cargo feature names in reports generated by `cargo build --timings`, potentially allowing for malicious HTML injection. A malicious package included as a dependency could inject JavaScript, creating cross-site scripting risks.
- CVE-2023-38497High
Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. This could allow other local users to modify the source code compiled and executed by the current user.
Original NVD description (English source)
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.