cargo
Rust / Cargo · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports | cargo | Rust / Cargo | Low | Fix reported | |
| Cargo prior to Rust 1.26.0 may download the wrong dependency | cargo | Rust / Cargo | High | Fix reported | |
| Cargo crates in third party registries can override the cached source of other crates | cargoRed Hat Enterprise Linux 9/goose | Rust / CargoRed Hat | Medium | Fix reported | |
| Cargo can be coerced to share credentials between registries | cargo | Rust / Cargo | Low | Fix reported | |
| Cargo not respecting umask when extracting crate archives | cargo | Rust / Cargo | High | Fix reported | |
| Cargo did not verify SSH host keys | cargo | Rust / Cargo | Medium | Fix reported | |
| Cargo extracting malicious crates can fill the file system | cargo | Rust / Cargo | Medium | Fix reported | |
| Cargo extracting malicious crates can corrupt arbitrary files | cargo | Rust / Cargo | Low | Fix reported |