CVE-2026-5223

A flaw was found in Cargo. When processing crate tarballs from third-party registries, Cargo mishandled symbolic links (symlinks) embedded within these archives. This vulnerability enables a malicious crate to overwrite the source code of another crate originating from the same registry. Such an action could lead to unauthorized modification of software components, potentially introducing security risks or operational disruptions.

This Moderate vulnerability in Cargo arises from improper handling of symlinks within crate tarballs downloaded from third-party registries. An attacker could exploit this by publishing a malicious crate containing symlinks, leading to the overwrite of source code from other crates in the same registry. Red Hat customers using crates.io are not affected, as crates.io prohibits symlinks in uploaded crates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using untrusted third-party Cargo registries. If third-party registries are necessary, ensure they enforce strict policies against symlinks in crate tarballs and verify the integrity of downloaded crates. No direct configuration or operational workaround is available within Cargo itself to prevent this specific symlink mishandling when using vulnerable third-party registries.