TI-2022-16536 CVE-2022-36113 · GHSA-rfj2-q3h3-hm5j
Extracting malicious crates can corrupt arbitrary files
Priority LOW 38
Cargo is a package manager for the rust programming language.
rust-lang
Records39All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9
Exploited now
rust-lang records in CISA KEVNo rust-lang vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Cargo · all components
TI-2023-19877 CVE-2023-38497 · GHSA-j3xp-wfr4-hx87
Cargo not respecting umask when extracting crate archives
Priority LOW 37
Cargo downloads the Rust project’s dependencies and compiles the project.
TI-2022-16537 CVE-2022-36114 · GHSA-2hvr-h6gw-qrxp
Extracting malicious crates can fill the file system
Priority LOW 31
Cargo is a package manager for the rust programming language.
TI-2026-04563 CVE-2026-5223 · GHSA-jq42-7mfv-hm57
Crates in third party registries can override the cached source of other crates
Priority LOW 29
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.
TI-2022-22820 CVE-2022-46176 · GHSA-r5w3-xm58-jv6j
Cargo did not verify SSH host keys
Priority LOW 28
Cargo is a Rust package manager.
TI-2026-04562 CVE-2026-5222 · GHSA-p688-r7jv-fm6f
Cargo can be coerced to share credentials between registries
Priority LOW 13
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.