Cargo Symlink Flaw Disclosed as CVE-2026-5223

The Rust Security Response Team disclosed a Cargo vulnerability, tracked as CVE-2026-5223, where symlinks inside crate tarballs from third-party registries were mishandled, letting a malicious crate overwrite the source of another crate from the same registry. The issue is rated medium severity for third-party registry users; crates.io is unaffected since it already bans symlinks in uploaded crates.

The root cause lies in how Cargo extracts crate source code into its local cache under ~/.cargo. While Cargo normally prevents files from escaping a crate's own cache directory, a crafted tarball could extract one directory level below it, corrupting the cache of sibling crates from the same registry.

Rust 1.96.0, shipping May 28, 2026, fixes this by rejecting any symlink found in crate tarballs regardless of registry source. Since Cargo never emits symlinks via cargo package or cargo publish, real-world impact is expected to be limited. Teams unable to upgrade immediately should audit their registries for symlinks and configure them to reject symlinks where supported. All Cargo versions prior to 1.96.0 are affected.