VYPR
← All advisories
High severity7.9NVD Advisory· Published Aug 4, 2023· Updated Jun 17, 2026

CVE-2023-38497

CVE-2023-38497

Description

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in ~/.cargo.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cargocrates.io
< 0.72.20.72.2

Affected products

22

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.