PT-2026-43025 · Rust · Cargo

Christos Papakonstantinou · Published 2026-05-25 · Updated 2026-06-26 · CVE-2026-5223

Positive Technologies (AI Summary)

CVSS v4.0

6.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Cargo versions prior to 1.96.0

Description Cargo incorrectly handled symbolic links (symlinks)—which are files that point to another file or directory—inside crate tarballs downloaded from third-party registries. This allows a malicious crate to override the source code of another crate originating from the same registry.

Recommendations Update to version 1.96.0.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

BDU:2026-08152

CVE-2026-5223

GHSA-JQ42-7MFV-HM57

Affected Products

Cargo

References · 21

• https://github.com/rust-lang/cargo/pull/17031 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5223 · Security Note
• https://bdu.fstec.ru/vul/2026-08152 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-5223 · Vendor Advisory
• https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-5223 · Vendor Advisory
• https://blog.rust-lang.org/2026/05/25/cve-2026-5223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5223 · Security Note
• https://osv.dev/vulnerability/GHSA-jq42-7mfv-hm57 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5223 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5223 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5223 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5223 · Vendor Advisory
• https://github.com/rust-lang/cargo/security/advisories/GHSA-jq42-7mfv-hm57 · Note
• https://github.com/rust-lang/cargo · Note