rust-lang/cargo Security Advisories | GitStock

medium2026-06-26

Cargo crates in third party registries can override the cached source of other crates

GHSA-jq42-7mfv-hm57 · CVE-2026-5223

low2026-06-26

Cargo can be coerced to share credentials between registries

GHSA-p688-r7jv-fm6f · CVE-2026-5222

low2023-08-24

Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

GHSA-wrrj-h57r-vx9p · CVE-2023-40030

high2023-08-03

Cargo not respecting umask when extracting crate archives

GHSA-j3xp-wfr4-hx87 · CVE-2023-38497

medium2023-01-10

Cargo did not verify SSH host keys

GHSA-r5w3-xm58-jv6j · CVE-2022-46176

low2022-09-16

Cargo extracting malicious crates can corrupt arbitrary files

GHSA-rfj2-q3h3-hm5j · CVE-2022-36113

medium2022-09-16

Cargo extracting malicious crates can fill the file system

GHSA-2hvr-h6gw-qrxp · CVE-2022-36114