Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
rust package can let malicious crate replace code
published 5 months ago
Summary
If your organization downloads Rust packages from third‑party registries, a crafted package could use symbolic links to overwrite the source files of another package from the same source. This could cause unexpected behavior or security risks in your applications. Switch to trusted registries such as crates.io or verify packages before use to avoid the issue.
What to do
- Update azure rust to version 1.75.0-30.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | rust |
< 1.75.0-30 Fix: upgrade to 1.75.0-30
|
Original advisory text
CVE-2026-5223 affecting package rust for versions less than 1.75.0-30
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
References
Timeline
Published25 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-88272 · OSV
Track software like this
Free during beta