Skip to content
OpenAdvisories

Vendor

Rust Project

2 known vulnerabilities.

Products

Cargo 1 std 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-5223

    Crates in third party registries can override the cached source of other crates

    Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of th…

    Rust Project Cargo rustc rustc Debian Ubuntu Alpine crates.io
  • Medium 6.3
    CVE-2025-11233

    Rust standard library didn't detect all path separators on Cygwin

    Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled…

    Rust Project std rustc rustc-1.88 Debian Ubuntu