Cargo flaws expose Rust third-party registries to crate cache overwrite and tar smuggling

The Rust Security Response Team disclosed Cargo vulnerabilities tracked as CVE-2026-5222 and CVE-2026-5223, highlighting risks in how Rust tooling processes package archives from third-party registries. In the published details for CVE-2026-5223, Cargo was found to mishandle symlinks inside crate tarballs, allowing a malicious crate to overwrite the cached source of another crate from the same registry by extracting files outside its intended cache path. The issue does not affect crates.io, which already blocks crates containing symlinks, but it affects Cargo versions shipped before Rust 1.96.0; the fix rejects extraction of any symlink found in crate tarballs.

The disclosures align with a separate advisory affecting the Rust package astral-tokio-tar, where a PAX header desynchronization bug in versions before 0.6.2 can cause tar archives to be interpreted differently from other implementations. That flaw can let attackers hide or reveal archive members unexpectedly and potentially smuggle files onto a victim filesystem during extraction. Together, the advisories underscore a broader supply-chain risk in Rust archive handling: malformed tar metadata and symlink processing can let malicious packages alter extracted contents in ways developers and automated tooling may not expect. Users are advised to upgrade to fixed releases and, where upgrades are not yet possible, audit registry content and block symlinks in published crates.