Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-5223 medium CVSS 5.3

Vulnerability in cargo (CVE-2026-5223)

Summary

Vulnerability in cargo (CVE-2026-5223). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 0.97.0 or later.

Original description

The description as published by the source.

The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.

This vulnerability is tracked as CVE-2026-5223. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io are not affected, as crates.io forbids uploading crates containing any symlink.

Overview

When building a crate, Cargo extracts its source code in a local cache (stored within ~/.cargo), reusing it for any future build. Cargo includes protections to prevent any file from being extracted outside of the crate's own cache directory.

It was discovered that it's possible to craft a malicious tarball able to extract files one level below the crate's own cache directory. With the way the cache is structured, that allowed the malicious crate to override the cache of other crates belonging to the same registry.

Mitigations

Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to reject extracting any symlink within crate tarballs, regardless of whether they come from crates.io (which already forbids them) or third-party registries. Note that Cargo never added symlinks when running cargo package or cargo publish, so the impact of this should be minimal.

Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of th…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-5223 has been found in cargo.
Risk of unauthorized operations or information disclosure. CVSS score: 5.3/10.
What to do: upgrade cargo to 0.97.0 or later.
If unsure, ask your IT team or search "cargo CVE-2026-5223" on the vendor's site.

CVE-2026-5223 (cargo) — CWE-61 / CVSS v3 5.3
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 0.97.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-61) exists in cargo.

📍 Affected scope

Check the vendor advisory for the affected versions of cargo.

🔥 Severity

Severity: Medium (CVSS 5.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 0.97.0.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'cargo' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'cargo' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で cargo を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade cargo to 0.97.0

    ステージング環境で 0.97.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

rust cargo
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.0"}]}]
crates.io cargo
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.97.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details