Cargo rejects symlinks in crate tarballs

Summary

Third-party registry users face cache hijacking risk where a malicious crate overwrites another crate's source via symlink traversal. This fix eliminates the attack vector without workflow changes since cargo package and cargo publish never created symlinks.

Why it matters

Third-party registry users face cache hijacking risk where a malicious crate overwrites another crate's source via symlink traversal. This fix eliminates the attack vector without workflow changes since cargo package and cargo publish never created symlinks.

Sources

1. 1.Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries
2. 2.possible to craft a malicious tarball able to extract files one level below the crate's own cache directory
3. 3.Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to reject extracting any symlink within crate tarballs
4. 4.Cargo never added symlinks when running cargo package or cargo publish