CVE-2023-38497

CVE-2023-38497 describes a vulnerability in Cargo, bundled with Rust prior to version 1.71.1, where it failed to respect the umask when extracting crate archives on UNIX-like systems. This flaw could allow a local attacker to modify source code compiled and executed by another user if a downloaded crate contained world-writable files. The vulnerability carries a CVSS score of 7.3 (HIGH), indicating a local attack vector with low complexity, potentially leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or inclusion in the KEV catalog, the vulnerability has garnered some community discussion and media coverage.