Fix CVE-2026-5222 and CVE-2026-5223 - #17031

Merged

weihanglo merged 2 commits into

rust-lang:masterfrom

emilyalbini:ea-cves-nightly

May 25, 2026

Commits on May 25, 2026

CVE-2026-5222: avoid stripping .git suffix when for non git registries

arlosi
authored and
emilyalbini
committed
CVE-2026-5223: prohibit unpacking symlinks and other unexpected entries

joshtriplett
authored and
emilyalbini
committed