Rust-lang Cargo vulnerabilities

• rust project cargo Crates in third party registries can override the cached source of other crates CVE-2026-5223 Fix available 6.5 MediumMay 25, 2026
• rust cargo Cargo can be coerced to share credentials between registries CVE-2026-5222 Fix available 2.3 LowMay 25, 2026
• rust-lang cargo, rust +1 more Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports CVE-2023-40030 Fix available 6.1 MediumAugust 24, 2023
• rust-lang cargo, fedoraproject fedora +1 more Cargo not respecting umask when extracting crate archives CVE-2023-38497 Public exploitFix available 7.8 HighAugust 3, 2023
• rust-lang cargo Cargo did not verify SSH host keys CVE-2022-46176 Fix available 5.3 MediumJanuary 10, 2023
• rust-lang cargo Extracting malicious crates can fill the file system CVE-2022-36114 Fix available 4.8 MediumSeptember 14, 2022
• rust-lang cargo Extracting malicious crates can corrupt arbitrary files CVE-2022-36113 Fix available 4.6 MediumSeptember 14, 2022
• rust cargo, rust-lang rust +1 more Cargo prior to Rust 1.26.0 may download the wrong dependency CVE-2019-16760 Fix available 4.6 MediumSeptember 30, 2019