Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-25 | 3 | Disclosure2General1 |
| 2026-05-29 | 1 | General1 |
JUST IN: Security Advisory for Cargo (CVE-2026-5223) >> Malicious crates with symlinks can override other crates from the same third-party registry. Fixed in Rust 1.96.0. #rustlang #rust https://t.co/DJPa1M2e0W
Post summary
This tweet announces the discovery of CVE‑2026‑5223, describing how symlinked malicious crates can override other crates in the same registry, and notes that the issue is fixed in Rust 1.96.0.
Cargo from Rust security advisories https://www.openwall.com/lists/oss-security/2026/05/28/5 CVE-2026-5222: Cargo can be coerced to share credentials between registries CVE-2026-5223: Crates in third party registries can override the cached source of other crates
Post summary
The advisories list two Rust Cargo CVEs noting credential sharing and crate overriding possibilities, but do not provide PoC, tooling, exploitation evidence, or patch details.
CVE-2026-5223 Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another cr… https://www.cve.org/CVERecord?id=CVE-2026-5223
Post summary
The text reports CVE-2026-5223: Cargo mishandles symlinks in crate tarballs, permitting a malicious crate to override another crate’s source code.
Security Advisory for Cargo (CVE-2026-5223) https://blog.rust-lang.org/2026/05/25/cve-2026-5223/
Post summary
The post references a Rust‑lang security advisory for CVE‑2026‑5223 with a link but provides no further details or claims about PoC, exploitation, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rust-lang | cargo | - | rust | - |