Security Advisory for Cargo (CVE-2026-5223)
CVE-2026-5223: Cargo incorrectly handled symlinks inside crate tarballs from third-party registries, allowing malicious crates to override another crate's source code. The fix ships in Rust 1.96.0 on May 28th, 2026. Crates.io users are unaffected.