Cargo vulnerabilities

Cargo incorrectly handles symbolic links inside crate tarballs downloaded from third-party registries, allowing a malicious crate to overwrite the source code of another crate from the same registry. The vulnerability is medium severity for users of third-party registries; crates.io users are not affected because crates.io forbids uploading crates containing symlinks.

Cargo between versions 1.68 and 1.96 incorrectly normalized URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries with arbitrary names in the same domain, an attacker could obtain credentials of other users. Severity is low due to niche requirements.

Cargo versions from 1.60.0 to 1.72 did not escape Cargo feature names in reports generated by `cargo build --timings`, potentially allowing for malicious HTML injection. A malicious package included as a dependency could inject JavaScript, creating cross-site scripting risks.

Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. This could allow other local users to modify the source code compiled and executed by the current user.