Rust Cargo CVE-2026-5223

Exploitation requires the victim's Cargo to be configured to use a third-party registry other than crates.io - this is the single hard prerequisite, and users exclusively relying on crates.io are explicitly not affected. The attacker must have the ability to publish a crate to that third-party registry (publisher account or compromised credential on that registry). On the victim side, no authentication is required (PR:N per CVSS 4.0) and no special build configuration is needed beyond having a dependency (direct or transitive) on the malicious crate. Passive user interaction is required (UI:P): the victim must execute a Cargo command that triggers download and unpacking, such as 'cargo build', 'cargo check', 'cargo fetch', or 'cargo update'. The symlink can only target crates from the same registry (overriding cross-registry sources is not implied by the description). Exploitation is limited to platforms where symlinks have filesystem effect - Windows behavior may differ but is not addressed in available data.

The CVSS 4.0 score of 6.5 (Medium) reflects an asymmetry between vulnerable-system and subsequent-system impact: the vulnerable system (the developer's Cargo process) has only low integrity impact (VI:L), but the subsequent system scores high across all pillars (SC:H/SI:H/SA:H), capturing the supply chain cascading effect - substituted source code, once compiled, can execute arbitrary logic with the developer's full privileges. The network attack vector (AV:N) with low complexity (AC:L) and no privileges required (PR:N) indicates ease of exploitation, tempered by passive user interaction (UI:P). EPSS of 0.04% at the 14th percentile is very low, and this CVE is not in CISA KEV, suggesting no observed active exploitation to date. The realistic risk is primarily to organizations using internal or alternative third-party Cargo registries where an insider or compromised publisher account could upload a malicious crate - an elevated concern for enterprise Rust shops relying on private registries. For the general Rust ecosystem via crates.io, this vulnerability poses zero risk by policy. The medium CVSS score likely underweights the build-time code execution potential for affected users.

An attacker with publish access to a third-party Cargo registry crafts a crate tarball containing a symlink at a predictable path - for example, bar-0.0.1/.cargo-ok pointing to the source directory of a widely depended-upon crate in the same registry's local cache. When a developer runs 'cargo build' on a project that depends on this malicious crate, Cargo downloads and unpacks the tarball, follows the symlink, and overwrites the target crate's source files with attacker-controlled content. On the next compilation, the substituted source is compiled and executed in the context of the developer's build environment, granting arbitrary code execution. No public exploit code has been identified at time of analysis, though the PR diff includes test cases that demonstrate the attack path.