Users of crates.io are not affected, as crates.io forbids uploading crates containing any symlink.
this post was submitted on 28 May 2026
19 points (100.0% liked)
Rust
8041 readers
59 users here now
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Wormhole
Credits
- The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)
founded 3 years ago
MODERATORS
The severity of the vulnerability is low, due to the extremely niche requirements needed to achieve the attack.
Mitigations
Rust 1.96, to be released on May 28th, 2026
Ok, so it'll get fixed soon enough and 99% of people don't need to worry ๐
I'd venture a guess that 100% of people don't need to worry. Based on the complexity and requirements to execute this attack, I'd almost argue it's just a bug report framed as a vulnerability.
Maybe it's possible to exploit this somewhere in the wild, but it requires pulling from a custom registry that the attacker controls and voluntarily authenticating to it, from what I can tell anyway.