CVE-2026-5223— Crates in third party registries can override the cached source of other crates
Quick assessment
Affected
Rust Project Cargo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cargo是The Rust Programming Language开源的一个 Rust 包管理器。 Cargo存在安全漏洞，该漏洞源于错误处理从第三方注册表下载的crate tarball中的符号链接，可能导致恶意crate覆盖同一注册表中其他crate的源代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1030 · Data Transfer Size LimitsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Rust Project | Cargo | 1.0.0< 1.96.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-5223
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Crates in third party registries can override the cached source of other crates
Source: CVE Program / CVE List V5
Vulnerability Description
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-61
Source: CVE Program / CVE List V5
Vulnerability Title
Cargo 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cargo是The Rust Programming Language开源的一个 Rust 包管理器。 Cargo存在安全漏洞，该漏洞源于错误处理从第三方注册表下载的crate tarball中的符号链接，可能导致恶意crate覆盖同一注册表中其他crate的源代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rust Project | Cargo | 1.0.0 ~ 1.96.0 | - |
|
II. Public POCs for CVE-2026-5223
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5223
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-5223 (1)
Security Blog Posts for CVE-2026-5223 (1)
-
🔗 Security Advisory for Cargo (CVE-2026-5223) | Rust Blog vendor-advisory
Other References for CVE-2026-5223 (1)
-
🔗 CVE-2026-5223: Crates in third party registries can override the cached source of other crates vendor-advisory mailing-list
IV. Related Vulnerabilities
Same product: Cargo
-
CVE-2026-5222
Cargo can be coerced to share credentials between registries -
CVE-2023-40030
Malicious dependencies can inject arbitrary JavaScript into -
CVE-2023-38497
Cargo not respecting umask when extracting crate archives -
CVE-2022-46176
Cargo did not verify SSH host keys -
CVE-2022-36113
Extracting malicious crates can corrupt arbitrary files
Same weakness: CWE-61
-
CVE-2026-97024
Flatpak: flatpak: arbitrary write in root context via path t -
CVE-2026-97023
Flatpak: flatpak: arbitrary file deletion in root context vi -
CVE-2026-96808
Flatpak 1.18.1前符号链接遍历致本地提权 -
CVE-2026-96807
Flatpak 1.18.1前ld.so符号链接致任意文件写入 -
CVE-2026-91202
Cockpit-files: cockpit-files: arbitrary file ownership chang
V. Comments for CVE-2026-5223
No comments yet