cargo (crates.io)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.72 or later clears every advisory below that has a fix.

Upgrade commands

cargo

cargo update -p cargo --precise 1.72

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-jq42-7mfv-hm57 Cargo crates in third party registries can override the cached source of other crates	Medium EPSS 0.29%	`< 0.97.0`	`0.97.0`
GHSA-p688-r7jv-fm6f Cargo can be coerced to share credentials between registries	Medium EPSS 0.48%	`< 0.97.0`	`0.97.0`
GHSA-wrrj-h57r-vx9p Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports	Medium EPSS 0.90%	`>= 1.60.0, < 1.72`	`1.72`
GHSA-j3xp-wfr4-hx87 Cargo not respecting umask when extracting crate archives	High EPSS 0.70%	`< 0.72.2`	`0.72.2`
GHSA-r5w3-xm58-jv6j Cargo did not verify SSH host keys	Medium EPSS 0.68%	`< 0.67.1`	`0.67.1`
GHSA-2hvr-h6gw-qrxp Cargo extracting malicious crates can fill the file system	Medium EPSS 0.95%	`< 0.65.0`	`0.65.0`
GHSA-2hvr-h6gw-qrxp Cargo extracting malicious crates can fill the file system	Medium EPSS 0.95%	`>= 0.66.0, < 0.67.0`	`0.67.0`
GHSA-rfj2-q3h3-hm5j Cargo extracting malicious crates can corrupt arbitrary files	High EPSS 1.21%	`>= 0.66.0, < 0.67.0`	`0.67.0`
GHSA-rfj2-q3h3-hm5j Cargo extracting malicious crates can corrupt arbitrary files	High EPSS 1.21%	`< 0.65.0`	`0.65.0`
GHSA-9f3p-wvj7-q82x Cargo prior to Rust 1.26.0 may download the wrong dependency	High EPSS 1.26%	`< 0.27.0`	`0.27.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor