Cargo fails to reject symlinks inside crate tarballs from third‑party registries, allowing a malicious crate to overwrite the source of another crate pulled from the same registry. This permits an attacker to inject arbitrary code into dependencies that use Cargo, potentially leading to compromise of applications that depend on the tampered crate. The weakness is a classic Path Traversal/Lnk exploit (CWE‑61) and the described impact is rated medium with a CVSS score of 6.5.

The flaw affects all releases of Rust Project Cargo prior to the upcoming Rust 1.96.0 update scheduled for 28 May 2026. Any user that relies on third‑party registries for crate distribution is subject to the issue, while crates.io users remain protected because the registry forbids symlinks. The vulnerability is specific to Cargo, the default Rust package manager.

The CVSS score reflects a moderate degree of risk, and the EPSS score is not available, while the vulnerability is not listed in CISA KEV. The threat is executed by an adversary who can publish a malicious crate with a symlink that points to the source of another crate; when Cargo extracts the tarball the symlink replaces the target file, thereby corrupting the other crate's code base. Attackers therefore need control over a third‑party registry or the ability to force downstream consumers to install the malicious crate (e.g., via transitive dependency).