Is cargo safe to use? Its security history

Every advisory, newest first

• VulnerabilityGHSA-jq42-7mfv-hm57 · 2026-06-26Cargo crates in third party registries can override the cached source of other crates
• VulnerabilityGHSA-p688-r7jv-fm6f · 2026-06-26Cargo can be coerced to share credentials between registries
• VulnerabilityGHSA-wrrj-h57r-vx9p · 2023-08-24Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports
• VulnerabilityGHSA-j3xp-wfr4-hx87 · 2023-08-03Cargo not respecting umask when extracting crate archives
• VulnerabilityGHSA-r5w3-xm58-jv6j · 2023-01-10Cargo did not verify SSH host keys
• VulnerabilityGHSA-rfj2-q3h3-hm5j · 2022-09-16Cargo extracting malicious crates can corrupt arbitrary files
• VulnerabilityGHSA-rfj2-q3h3-hm5j · 2022-09-16Cargo extracting malicious crates can corrupt arbitrary files
• VulnerabilityGHSA-2hvr-h6gw-qrxp · 2022-09-16Cargo extracting malicious crates can fill the file system
• VulnerabilityGHSA-2hvr-h6gw-qrxp · 2022-09-16Cargo extracting malicious crates can fill the file system
• VulnerabilityGHSA-9f3p-wvj7-q82x · 2022-05-24Cargo prior to Rust 1.26.0 may download the wrong dependency

Check your version

Run cargo tree -i cargo to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.