Users of crates.io are not affected, as crates.io forbids uploading crates containing any symlink.
The severity of the vulnerability is low, due to the extremely niche requirements needed to achieve the attack.
Mitigations
Rust 1.96, to be released on May 28th, 2026
Ok, so it'll get fixed soon enough and 99% of people don't need to worry ๐
I'd venture a guess that 100% of people don't need to worry. Based on the complexity and requirements to execute this attack, I'd almost argue it's just a bug report framed as a vulnerability.
Maybe it's possible to exploit this somewhere in the wild, but it requires pulling from a custom registry that the attacker controls and voluntarily authenticating to it, from what I can tell anyway.
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Credits