Rust Security Advisory: CVE-2026-33056 Vulnerability in Cargo's Tar Crate
The Rust Security Response Team issued a security advisory regarding a critical vulnerability, identified as CVE-2026-33056, within the third-party 'tar' crate utilized by Cargo for package extraction during builds. This flaw permits malicious crates to alter permissions on arbitrary filesystem directories. To mitigate risks for public registry users, protective measures were implemented on March 13, 2026, preventing the upload of exploitative crates, followed by a comprehensive audit confirming no existing crates on crates.io are affected. Users of alternate registries are advised to contact their vendors for verification. A patched version of the toolchain, Rust 1.94.1, is scheduled for release on March 26, 2026, incorporating the fixed 'tar' crate. However, this update will not safeguard older Cargo versions using alternate registries. The team acknowledged Sergei Zimmerman for discovering the vulnerability and William Woodruff for assistance with mitigations. Key contributors included Eric Huss, Tobias Bieniek, Adam Harvey, Walter Pearce, Emily Albini, and Josh Stone, who coordinated the response and technical patches.
Wire timeline
Rust Security Advisory: CVE-2026-33056 Vulnerability in Cargo's Tar Crate
The Rust Security Response Team issued a security advisory regarding a critical vulnerability, identified as CVE-2026-33056, within the third-party 'tar' crate utilized by Cargo for package extraction during builds. This flaw permits malicious crates to alter permissions on arbitrary filesystem directories. To mitigate risks for public registry users, protective measures were implemented on March 13, 2026, preventing the upload of exploitative crates, followed by a comprehensive audit confirming no existing crates on crates.io are affected. Users of alternate registries are advised to contact their vendors for verification. A patched version of the toolchain, Rust 1.94.1, is scheduled for release on March 26, 2026, incorporating the fixed 'tar' crate. However, this update will not safeguard older Cargo versions using alternate registries. The team acknowledged Sergei Zimmerman for discovering the vulnerability and William Woodruff for assistance with mitigations. Key contributors included Eric Huss, Tobias Bieniek, Adam Harvey, Walter Pearce, Emily Albini, and Josh Stone, who coordinated the response and technical patches.
Rust Blog