CVE-2026-5223 Details
Description
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
A medium-severity vulnerability has been identified in Cargo, the Rust package manager, affecting all versions prior to 1.96.0. The issue arises from Cargo's improper management of symlinks within crate tarballs downloaded from third-party registries. This flaw enables a malicious crate to overwrite the source code of another crate from the same registry. Notably, users of crates.io are not affected, as this registry prohibits the upload of crates containing symlinks.
Cargo has been updated in Rust 1.96.0 to reject the extraction of any symlink within crate tarballs, regardless of the registry. Users who cannot upgrade to this version should audit their registry for symlinks and configure their registry to reject them if possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.rust-lang.org/2026/05/25/cve-2026-5223/ | rust | MitigationVendor Advisory |
| https://github.com/rust-lang/cargo/pull/17031 | rust | Issue TrackingPatch |
| https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8 | rust | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | rust |
Affected Products
| Product | Versions |
|---|---|
| rust-lang cargo | < 1.96.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | rust |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 25, 2026 | New CVE Received | rust |