CVE-2026-5223
published 2026-05-25CVE-2026-5223: Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.29%
21.7th percentile
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rust-lang | cargo | < 1.96.0 | 1.96.0 |
| rust-lang | rust | — | — |
| rust_project | cargo | >= 0 < 0.97.0 | 0.97.0 |
| rust_project | cargo | >= 1.0.0 < 1.96.0 | 1.96.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cvelistv5v4.06.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
ghsa5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cargo crates in third party registries can override the cached source of other crates
ghsa·2026-06-26·CVSS 5.3
CVE-2026-5223 [MEDIUM] CWE-61 Cargo crates in third party registries can override the cached source of other crates
Cargo crates in third party registries can override the cached source of other crates
The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.
This vulnerability is tracked as CVE-2026-5223. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
## Overview
When building a crate, Cargo extracts its source code in a local cache (stored within `~/.cargo`), reusing it for any future build. Cargo includes protections to prevent any file from being extracted outside of the c
VulDB
rust-lang Cargo up to 1.95.x symlink (EUVD-2026-31658)
vuldb·2026-05-25
CVE-2026-5223 [CRITICAL] rust-lang Cargo up to 1.95.x symlink (EUVD-2026-31658)
A vulnerability has been found in rust-lang Cargo up to 1.95.x and classified as critical. Affected by this issue is some unknown functionality. Performing a manipulation results in symlink following.
This vulnerability is reported as CVE-2026-5223. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
CVEList
Crates in third party registries can override the cached source of other crates
cvelistv5·2026-05-25·CVSS 6.5
CVE-2026-5223 [MEDIUM] CWE-61 Crates in third party registries can override the cached source of other crates
Crates in third party registries can override the cached source of other crates
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
Red Hat
cargo: Cargo: Source code overwrite due to symlink mishandling in third-party registries
vendor_redhat·2026-05-25·CVSS 5.3
CVE-2026-5223 [MEDIUM] CWE-22 cargo: Cargo: Source code overwrite due to symlink mishandling in third-party registries
cargo: Cargo: Source code overwrite due to symlink mishandling in third-party registries
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
A flaw was found in Cargo. When processing crate tarballs from third-party registries, Cargo mishandled symbolic links (symlinks) embedded within these archives. This vulnerability enables a malicious crate to overwrite the source code of another crate originating from the same registry. Such an action could lead to unautho
No detection rules found.
No public exploits indexed.
2026-05-25
Published