CVE-2026-5223

Crates in third party registries can override the cached source of other crates

CVSS 6.5 MEDIUMEPSS 0.3%CWE-61

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

25 May 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Affected products

Rust Project · Cargo

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://blog.rust-lang.org/2026/05/25/cve-2026-5223/https://github.com/rust-lang/cargo/pull/17031 https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8