Summary
Malicious registry crates can overwrite dependency source. This medium-severity finding affects Cargo.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
Malicious registry crates can overwrite dependency source
CVE-2026-5223
- Affected product
- Cargo
- Severity
- Medium
- Weakness
- CWE-61
- Disclosed