CVE-2026-5223

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5223", "assignerOrgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "state": "PUBLISHED", "assignerShortName": "rust", "dateReserved": "2026-03-31T12:07:41.420Z", "datePublished": "2026-05-25T08:57:08.488Z", "dateUpdated": "2026-05-27T18:35:35.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "shortName": "rust", "dateUpdated": "2026-05-25T08:57:08.488Z"}, "title": "Crates in third party registries can override the cached source of other crates", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-61", "description": "CWE-61 UNIX symbolic link (symlink) following", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-141", "descriptions": [{"lang": "en", "value": "CAPEC-141 Cache Poisoning"}]}], "affected": [{"vendor": "Rust Project", "product": "Cargo", "collectionURL": "https://crates.io", "packageName": "cargo", "repo": "https://github.com/rust-lang/cargo", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.96.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.\u00a0The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.&nbsp;The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink."}]}], "references": [{"url": "https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8", "tags": ["vendor-advisory", "mailing-list"]}, {"url": "https://blog.rust-lang.org/2026/05/25/cve-2026-5223/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/rust-lang/cargo/pull/17031", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H"}}], "workarounds": [{"lang": "en", "value": "Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).<br>"}]}], "solutions": [{"lang": "en", "value": "Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to \nreject extracting *any* symlink within crate tarballs, regardless of \nwhether they come from crates.io (which already forbids them) or \nthird-party registries. Note that Cargo never added symlinks when \nrunning `cargo package` or `cargo publish`, so the impact of this should be\n minimal.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to \nreject extracting *any* symlink within crate tarballs, regardless of \nwhether they come from crates.io (which already forbids them) or \nthird-party registries. Note that Cargo never added symlinks when \nrunning `cargo package` or `cargo publish`, so the impact of this should be\n minimal."}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T14:36:37.949868Z", "id": "CVE-2026-5223", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:35:35.093Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5223", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T14:36:37.949868Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T14:36:35.401Z"}}], "cna": {"title": "Crates in third party registries can override the cached source of other crates", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-141", "descriptions": [{"lang": "en", "value": "CAPEC-141 Cache Poisoning"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/rust-lang/cargo", "vendor": "Rust Project", "product": "Cargo", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.96.0", "versionType": "semver"}], "packageName": "cargo", "collectionURL": "https://crates.io", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to \nreject extracting *any* symlink within crate tarballs, regardless of \nwhether they come from crates.io (which already forbids them) or \nthird-party registries. Note that Cargo never added symlinks when \nrunning `cargo package` or `cargo publish`, so the impact of this should be\n minimal.", "supportingMedia": [{"type": "text/html", "value": "Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to \nreject extracting *any* symlink within crate tarballs, regardless of \nwhether they come from crates.io (which already forbids them) or \nthird-party registries. Note that Cargo never added symlinks when \nrunning `cargo package` or `cargo publish`, so the impact of this should be\n minimal.", "base64": false}]}], "references": [{"url": "https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8", "tags": ["vendor-advisory", "mailing-list"]}, {"url": "https://blog.rust-lang.org/2026/05/25/cve-2026-5223/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/rust-lang/cargo/pull/17031", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).", "supportingMedia": [{"type": "text/html", "value": "Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.\u00a0The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.", "supportingMedia": [{"type": "text/html", "value": "Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.&nbsp;The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61 UNIX symbolic link (symlink) following"}]}], "providerMetadata": {"orgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "shortName": "rust", "dateUpdated": "2026-05-25T08:57:08.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5223", "state": "PUBLISHED", "dateUpdated": "2026-05-27T18:35:35.093Z", "dateReserved": "2026-03-31T12:07:41.420Z", "assignerOrgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "datePublished": "2026-05-25T08:57:08.488Z", "assignerShortName": "rust"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://crates.io", "defaultStatus": "unaffected", "packageName": "cargo", "product": "Cargo", "repo": "https://github.com/rust-lang/cargo", "vendor": "Rust Project", "versions": [{"lessThan": "1.96.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "986d4109-89ea-491f-99fd-a8e4803919bd"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*", "matchCriteriaId": "67F6F381-6055-48F2-A156-047F903ABE84", "versionEndExcluding": "1.96.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.\u00a0The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink."}, {"lang": "es", "value": "Cargo gestion\u00f3 incorrectamente los enlaces simb\u00f3licos dentro de los tarballs de crates descargados de registros de terceros, permitiendo que un crate malicioso sobrescribiera el c\u00f3digo fuente de otro crate del mismo registro. La gravedad de la vulnerabilidad es media para los usuarios de registros de terceros. Los usuarios de crates.io no se ven afectados, ya que crates.io proh\u00edbe subir crates que contengan enlaces simb\u00f3licos."}], "id": "CVE-2026-5223", "lastModified": "2026-07-23T17:10:00.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "986d4109-89ea-491f-99fd-a8e4803919bd", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5223", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T14:36:37.949868Z", "version": "2.0.3"}}]}, "published": "2026-05-25T10:16:15.480", "references": [{"source": "986d4109-89ea-491f-99fd-a8e4803919bd", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://blog.rust-lang.org/2026/05/25/cve-2026-5223/"}, {"source": "986d4109-89ea-491f-99fd-a8e4803919bd", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rust-lang/cargo/pull/17031"}, {"source": "986d4109-89ea-491f-99fd-a8e4803919bd", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8"}], "sourceIdentifier": "986d4109-89ea-491f-99fd-a8e4803919bd", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "986d4109-89ea-491f-99fd-a8e4803919bd", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.96.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Cargo", "source": "cna", "vendor": "Rust Project"}, "product": "cargo", "vendor": "rust-lang"}], "created": "2026-05-25T10:30:22.990098+00:00", "updated": "2026-05-26T13:01:00.248933+00:00", "vendors": ["rust-lang", "rust-lang$PRODUCT$cargo"]}