CVE-2026-5223: Rust-Lang Cargo

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.

Affected products

• Rust-Lang Cargo: before 1.96.0 (fixed in 1.96.0)

Published 2026-05-25. Last modified 2026-07-23.