Rust Cargo CVE-2026-5223

The upstream fix is available in GitHub PR #17031 (https://github.com/rust-lang/cargo/pull/17031); however, the specific patched Cargo release version is not independently confirmed from available data - check the official advisory at https://blog.rust-lang.org/2026/05/25/cve-2026-5223/ for the exact fixed release. Once confirmed, upgrade via 'rustup update stable' to obtain the patched Cargo bundled with the new stable Rust release. As a compensating control while awaiting the patch, organizations should audit and restrict Cargo's configured registry sources to trusted, access-controlled registries only - operators of third-party registries should enforce a symlink-rejection policy analogous to crates.io's. As a more aggressive control, removing third-party registry entries from ~/.cargo/config.toml or Cargo.toml eliminates the attack surface entirely but will break any builds depending on those registries. Auditing the local Cargo registry cache (typically ~/.cargo/registry/src/) for unexpected symlinks can help detect prior exploitation.