Cargo versions including 1.0.0 improperly handle symbolic links within crate tarballs downloaded from third-party registries. This vulnerability (CWE-61) enables a malicious actor to craft a crate that uses symlinks to overwrite or replace the source code of other crates from the same registry, potentially leading to supply chain compromise. The issue does not affect crates.io users as that registry disallows symlinks in uploaded crates. The CVSS 4.0 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity with high scope and security requirements.

The vulnerability allows an attacker controlling a crate in a third-party registry to override source code of other crates from that registry when Cargo downloads and extracts them. This can lead to supply chain attacks affecting users who rely on third-party registries that permit symlinks. Users of crates.io are not impacted. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using third-party registries that allow symlinks in crate tarballs or verify the integrity of crates before use. Users of crates.io are not affected and require no action. Monitor official Rust Project advisories for updates and patches addressing this issue.