Threats affecting pkg:cargo/github/rust-lang/cargo

CVE-2026-5223 is a medium severity vulnerability in Rust's Cargo tool where symlinks inside crate tarballs from third-party registries are incorrectly handled. This flaw allows a malicious crate to override the source code of another crate from the same registry. Users of the official crates.io registry are not affected because it forbids uploading crates containing symlinks.

CVE-2026-5222 is a low-severity vulnerability in Rust Cargo version 1.68.0 where URL normalization for third-party registries using the sparse index protocol is incorrect. This flaw could allow an attacker who can publish crates in a registry hosted on a domain with multiple arbitrary-named registries to potentially obtain credentials of other users of the same registry. Exploitation requires very specific conditions, limiting the overall impact.