Crates in third party registries can override the cached source of other crates
Summary
| CVE | CVE-2026-5223 |
|---|---|
| State | PUBLISHED |
| Assigner | rust |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-25 10:16:15 UTC |
| Updated | 2026-05-26 19:08:15 UTC |
| Description | Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink. |
Risk And Classification
Primary CVSS: v4.0 6.5 MEDIUM from 986d4109-89ea-491f-99fd-a8e4803919bd
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.000440000 probability, percentile 0.136370000 (date 2026-05-27)
Problem Types: CWE-61 | CWE-61 CWE-61 UNIX symbolic link (symlink) following
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 986d4109-89ea-491f-99fd-a8e4803919bd | Secondary | 6.5 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/C... |
| 4.0 | CNA | CVSS | 6.5 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Rust Project | Cargo | affected 1.0.0 1.96.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8 | 986d4109-89ea-491f-99fd-a8e4803919bd | groups.google.com | |
| github.com/rust-lang/cargo/pull/17031 | 986d4109-89ea-491f-99fd-a8e4803919bd | github.com | |
| blog.rust-lang.org/2026/05/25/cve-2026-5223 | 986d4109-89ea-491f-99fd-a8e4803919bd | blog.rust-lang.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to reject extracting *any* symlink within crate tarballs, regardless of whether they come from crates.io (which already forbids them) or third-party registries. Note that Cargo never added symlinks when running `cargo package` or `cargo publish`, so the impact of this should be minimal.
Workarounds
CNA: Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).