CVE-2026-5223 PUBLISHED

Crates in third party registries can override the cached source of other crates

Assigner: rust
Reserved: 31.03.2026 Published: 25.05.2026 Updated: 25.05.2026

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io are not affected, as crates.io forbids uploading crates containing any symlink.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
CVSS Score: 6.5

Product Status

Vendor Rust Project
Product Cargo
Versions Default: unaffected
  • affected from 1.0.0 to 1.96.0 (excl.)

Workarounds

Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).

Solutions

Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to reject extracting any symlink within crate tarballs, regardless of whether they come from crates.io (which already forbids them) or third-party registries. Note that Cargo never added symlinks when running cargo package or cargo publish, so the impact of this should be minimal.

References

Problem Types

  • CWE-61 UNIX symbolic link (symlink) following CWE

Impacts

  • CAPEC-141 Cache Poisoning